BLUERABBIT Backdoor Targets Windows Systems With File Encryption

A new Golang-based backdoor known as BLUERABBIT is actively targeting Windows systems with a devastating mix of data exfiltration, file encryption, and disk-wiping capabilities.

First observed in mid-to-late March 2026 and suspected to be targeting entities in Israel, this malware is linked to an Iran-nexus threat actor.

According to the Google Threat Intelligence Group (GTIG), this activity cluster is the same one responsible for the BLUEWIPE and SEWERGOO malware observed in June 2025.

BLUERABBIT stands out because it hides its command-and-control traffic within legitimate enterprise message-broker protocols, making it difficult for standard security tools to detect.

The malware acts as a full-spectrum intrusion tool designed for high-impact operations.

Rather than relying on traditional HTTP-based communication, BLUERABBIT routes its tasking through RabbitMQ, manages state using Redis, and steals data via MinIO, an S3-compatible cloud storage service.

This combination allows attackers to quietly extract sensitive information before deploying destructive payloads.

Because data is stolen before files are encrypted with a .candy extension, attackers employ a double-extortion model, where victims face both operational downtime and the threat of data leaks.

BLUERABBIT Targets Windows Files

BLUERABBIT operates on a highly modular tasking system where the control server sends numeric task IDs to trigger specific functions.

The malware initiates its attack by connecting to RabbitMQ and declaring a queue named after the victim’s device. Through this queue, it receives tasks in JSON format and writes the results back to Redis.

The malware includes over a dozen built-in modules designed to compromise systems completely. Key capabilities include:

Full remote desktop control using VNC with keyboard and mouse input. Comprehensive system profiling that gathers details on the operating system, network settings, security products, and BitLocker status.

Data exfiltration that stages files in custom directories before sending them to attacker-controlled MinIO servers. File encryption that locks files across all logical drives and replaces the desktop wallpaper with an AI-generated warning image.

Disk wiping modules that can perform single-pass random data overwrites or multi-pass sequences to render systems permanently unrecoverable.

Before executing destructive actions, the backdoor meticulously prepares the system to prevent recovery. It uses built-in Windows commands to seize ownership of critical boot files, including bootmgr and ntoskrnl.exe.

Additionally, it modifies several registry keys to turn off automatic reboots, block system recovery, and stop scheduled maintenance. This ensures the encryption or wiping process completes without interruption.

According to binarydefense research, BLUERABBIT relies on a deceptive scheduled task. Upon initial execution, it checks a specific registry key to confirm whether it has run before.

If not, it uses PowerShell to create a scheduled task named OneDrive Update. This task is configured to start at system boot.

It repeats every 60 seconds, meaning simply terminating the malware process is not enough to remove it. The scheduled task itself must be deleted to break persistence entirely.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.