Loading story…
Binary Defense disclosed a newly identified Go-based Windows backdoor, BLUERABBIT, that provides attackers with persistent access, reconnaissance, screenshot and screen-recording capture, shell execution, and data theft before escalating to file encryption and destructive wiping. The malware is assessed as likely tied to an Iran-nexus activity cluster and appears primarily aimed at organizations in Israel. Researchers said BLUERABBIT was first observed in mid-to-late March 2026 and linked it to activity associated with BLUEWIPE and SEWERGOO.
BLUERABBIT blends into enterprise environments by using RabbitMQ over AMQP for command-and-control, Redis for task state management, and MinIO for S3-compatible exfiltration. It persists through a scheduled task named "OneDrive Update", stores staging data under HKCU\Software\OneDrive, can encrypt files with the .candy extension, and includes two wiping routines that disable Windows recovery mechanisms and alter boot-file permissions to make systems unrecoverable. Detection opportunities include anomalous AMQP traffic from workstations, suspicious MinIO client execution, unusual GUID-like staging folders, the fake OneDrive task, and unauthorized use of tools such as takeown or icacls against critical boot files.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Binary Defense published a report detailing BLUERABBIT's use of RabbitMQ, Redis, and MinIO, along with its persistence, encryption, and disk-wiping capabilities. The report also released detection opportunities, file hashes, IP addresses, and TLS fingerprints as indicators of compromise.
Binary Defense said the BLUERABBIT Golang backdoor and destructive intrusion tool was first observed in mid-to-late March 2026. The activity was assessed as primarily targeting entities in Israel.
Binary Defense reported that Google Threat Intelligence Group had previously linked the BLUEWIPE and SEWERGOO activity from June 2025 to a likely Iran-nexus activity cluster later associated with BLUERABBIT.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcebinarydefense.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed a destructive Go-based Windows backdoor dubbed **GigaWiper** that has been observed in compromised environments since October 2025, combining espionage, remote access, and sabotage functions in a single modular implant. The malware supports about 20 command codes and can wipe physical disks, overwrite the Windows drive, trigger BSOD-based disruption, clear event logs, manipulate processes, services, and the registry, capture screenshots, record screens, and provide hidden VNC-like remote control. It also masquerades as OneDrive and uses **RabbitMQ**, **Redis**, and in some reporting **MinIO** for command, result handling, and data exfiltration. Microsoft said GigaWiper appears to be assembled from at least three malware families, with code overlaps linking it to **Crucio** and **FlockWiper** and references to a broader framework labeled **GRAT**. One destructive component mimics ransomware by encrypting files without preserving a recovery key, making restoration impossible except from clean backups, while another performs multi-pass secure wiping. Separate reporting said the same hashes and command-and-control infrastructure matched Binary Defense's earlier **BLUERABBIT** findings, and cited broader research associating related tooling with likely Iran-linked operations targeting Israeli organizations, though Microsoft did not publicly attribute the activity to a country.
Jul 10, 2026
Arctic Wolf reported multiple 2026 intrusions tied to the **Anubis** ransomware-as-a-service operation in which affiliates gained initial access through abused VPN credentials and exploitation of **CitrixBleed 2** (`CVE-2025-5777`) on NetScaler ADC and Gateway systems. The intrusions then progressed through lateral movement over **RDP** and **SMB**, credential harvesting, use of **PsExec**, and efforts to reduce security visibility before ransomware was deployed and files were encrypted with the `.anubis` extension. Investigators said the attackers relied heavily on legitimate remote management, tunneling, and data-transfer tools during the pre-encryption phase, including **ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, Total Software Deployment, cloudflared, SSH tunnels, rclone, s5cmd,** and **S3 Browser**. The activity shows Anubis affiliates blending living-off-the-land techniques with benign-looking administration software to stage data and maintain access, giving defenders an opportunity to detect attacks earlier by treating unusual clusters of remote-access, credential, tunneling, and cloud-transfer behavior as signs of compromise rather than routine IT activity.
Jul 8, 2026
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026