New Gryxa Toolkit Uses AI-Built Persistence to Fight Back Against Security Teams

A financially motivated threat actor using a new Windows toolkit named Gryxa that combines remote monitoring and management abuse, AI-assisted development, browser credential theft, and aggressive persistence designed to survive incomplete remediation.

The toolkit’s most unusual feature is its ability to collect evidence of how defenders removed its visible access and send that information back to the operator.

The activity marks what ReliaQuest assesses is its first observed case in which a threat actor used an AI coding agent to help develop and operate an attack ecosystem at this scale.

Analysis of the actor’s public repository found a commercial AI coding agent listed as co-author on most commits, alongside engineering rules, session handover notes, and case files documenting failed installations and subsequent code changes.

Rather than using AI solely for one-off tasks such as generating commands or processing stolen data, the operator appears to have used it throughout the development lifecycle: building the toolkit, the web-based fleet console.

The console reportedly listed 324 compromised hosts, with 69 online during ReliaQuest’s analysis, although not every listed system can be confirmed as an active victim.

Gryxa begins by abusing legitimate RMM software to establish covert access.

The installer, likely delivered through an invoice-themed self-extracting executable, downloads additional components via HTTPS from actor-controlled infrastructure and public code-hosting services.

It then distributes hidden files across several ProgramData locations, including a primary WinRTCS directory and folders masquerading as Windows error-reporting and diagnostic caches.

The malware’s core strength is recovery engineering. Gryxa uses multiple independent persistence layers, including at least seven scheduled tasks, a permanent Windows Management Instrumentation event subscription and an off-path backup of its files.

Three tasks run as SYSTEM at one-, five- and 15-minute intervals, enabling the toolkit to recreate removed components quickly.

If responders delete only the visible RMM client or primary installation directory, surviving mechanisms can restore the operation, often within minutes.

Gryxa Toolkit Uses AI

ReliaQuest Researchers said that, the toolkit can turn a partial containment effort into a defensive liability. When its relay infrastructure becomes unreachable, Gryxa’s guard component begins tracking failed check-ins.

After two consecutive failures, it attempts to disable Microsoft Defender and stop hard-coded EDR services.

After a third failure, it retrieves the endpoint security product’s uninstall command from the Windows Registry and launches a silent uninstall attempt. The full sequence can unfold in roughly 10 to 13 minutes.

This means defenders should not simply terminate the visible RMM session first.

The recommended order is to block known actor infrastructure at the network edge, isolate the affected endpoint where possible, then remove scheduled tasks, WMI persistence, hidden working directories, backup files and the RMM implant in one coordinated operation.

Endpoint products with uninstall protection should have that control enabled before response actions begin.

Gryxa also targets saved credentials in Chromium-based browsers, including cryptocurrency exchange and financial-technology accounts.

The code contains several methods intended to defeat Chrome’s App-Bound Encryption, a protection introduced to make browser credential decryption harder for non-browser processes.

ReliaQuest verified the methods through code review but did not independently confirm successful decryption across every browser and version claimed by the toolkit.

Decrypted credentials are reportedly exfiltrated through Telegram bots, while wallet browser extensions are catalogued for later manual access.

Organizations should treat all credentials stored in reachable browser profiles as exposed, not only credentials associated with cryptocurrency services, because the toolkit decrypts accessible data before filtering results against its target list.

The most consequential capability emerges after remediation. If defenders remove the visible implant but leave a Gryxa component running.

The remaining code collects Windows event and service logs, process-creation records, scheduled-task and WMI details, RMM inventory data, and indicators of the attacker’s surviving channel.

It archives and uploads those artifacts, potentially revealing the responder’s tools, accounts and sequence of actions.

The case reinforces a wider operational shift: AI may allow individual operators to build and manage malware ecosystems once associated with small development teams.

Defenders should prioritize behavior-based detection for suspicious SYSTEM-level task creation, WMI event subscriptions, unauthorized RMM activity.

Defender policy modifications and abrupt endpoint-agent uninstall attempts, rather than depending solely on static hashes that a centralized update pipeline can rapidly rotate.

IOCs

Artifact	Details
wirbe[.]com	Actor-controlled domain
world.wirbe[.]com	Actor-controlled domain
cdn.wirbe[.]com	Actor-controlled domain
ver.wirbe[.]com	Actor-controlled domain
mesh.wirbe[.]com	Actor-controlled domain
seczio[.]com	Actor-controlled domain, legacy infrastructure still in use
debian.seczio[.]com	Actor-controlled domain, legacy infrastructure still in use

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide