The toolkit uses legitimate remote monitoring and management (RMM) software for covert access, maintains several recovery mechanisms, steals browser-stored credentials, and can retaliate by disabling endpoint security tools.
Its most unusual feature appears after defenders remove the visible RMM implant A surviving component gathers Windows logs and host artifacts that could reveal how the response was performed.
ReliaQuest linked Gryxa activity to a public code repository and an attacker-operated management console. The console listed 324 hosts, with 69 shown as online during the investigation.
Researchers said many commits in the repository included co-author metadata from a commercial AI coding agent, suggesting artificial intelligence helped the actor build and operate the toolkit, its control console, and update system.
The researchers stressed that the findings concern third-party threats and do not indicate any vulnerability in ReliaQuest systems or data.
Gryxa Tracks Defender Removal
Gryxa is designed to survive incomplete remediation. It spreads files across multiple hidden directories, including C:\ProgramData\WinRTCS, Windows Error Reporting-like paths, and an off-path backup folder used to restore deleted components.
The malware uses at least seven scheduled tasks, a permanent Windows Management Instrumentation (WMI) event subscription, and redundant file storage.
Some tasks run as SYSTEM every one, five, or 15 minutes. If defenders remove only the RMM client or the main installation directory, remaining components can rebuild the toolkit.
Gryxa also reacts when it loses its connection to attacker infrastructure. A guard process checks the relay every five minutes.
After two failed checks, it attempts to disable Microsoft Defender and stop or disable endpoint detection and response agents from a hard-coded list.
After a third failure, it may retrieve an endpoint agent’s uninstall command from the Windows registry and silently uninstall it.
This means partial containment can create a serious risk. According to the research, defenders could see endpoint protection disabled or removed within roughly 10 to 13 minutes if they sever the attacker’s service without simultaneously removing Gryxa’s persistence mechanisms.
The toolkit also targets credentials stored in Chromium-based browsers. It contains code intended to bypass Chrome’s App-Bound Encryption protections and checks stolen logins against cryptocurrency exchange and financial-service domains.
It also identifies installed crypto-wallet extensions, potentially helping the operator prioritize high-value victims, ReliaQuest said.
Indicators of Compromise
| IOC Type | Indicator | Description |
|---|---|---|
| Domain | wirbe[.]com | Actor-controlled domain |
| Subdomain | world[.]wirbe[.]com | Actor-controlled infrastructure |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
 software for covert access, maintains several recovery mechanisms, steals){kind=link}