BLUERABBIT Backdoor Encrypts Files, Wipes Disks on Windows Systems

Key Takeaways

• A new backdoor, BLUERABBIT, is actively targeting Windows systems, combining file encryption, data theft, and disk-wiping capabilities.
• The malware, written in Go, is suspected to originate from an Iran-linked threat actor group, with primary targets identified as organizations in Israel.
• BLUERABBIT employs sophisticated evasion techniques, including mimicking legitimate network traffic via RabbitMQ and MinIO, and establishing persistence through a disguised “OneDrive Update” scheduled task.
• Defenders should monitor for anomalous folder names resembling GUIDs, unusual AMQP traffic, and unexpected MinIO client activity to detect and mitigate BLUERABBIT infections.

BLUERABBIT Backdoor: A Potent Threat to Windows Systems

A sophisticated new backdoor, dubbed BLUERABBIT, has emerged, posing a significant threat to Windows environments. Discovered in mid-to-late March 2026, this malware is not merely a data exfiltrator or a file locker; it is a comprehensive destructive tool capable of encrypting files, stealing sensitive data, and permanently wiping entire disks.

Investigators suspect the malware is the creation of an Iranian-linked threat actor. Their primary focus appears to be organizations located within Israel. The choice of the Go programming language for BLUERABBIT’s development allows it to blend seamlessly into typical network operations, making detection a considerable challenge for cybersecurity defenses.

Advanced Capabilities and Evasion Techniques

BLUERABBIT distinguishes itself through its extensive and destructive capabilities. Unlike many malware strains that specialize in a single form of attack, BLUERABBIT can execute multiple malicious actions concurrently. It can encrypt user files, simultaneously exfiltrate data, and, when commanded by its operators, initiate a complete and irreversible wipe of all drives on a compromised machine. This indicates a meticulously engineered platform designed for persistent, full-spectrum control rather than opportunistic, quick-hit attacks.

According to analysts at Binary Defense, who published their findings in a report shared with Cyber Security News (CSN), BLUERABBIT is attributed to the same threat group responsible for BLUEWIPE and SEWERGOO, two tools observed in June 2025. The malware’s internal designation as “Rabbit” and its compilation as a developmental build with intact symbols provided researchers with rare insight into its operational mechanics.

One of BLUERABBIT’s most cunning evasion tactics involves its command-and-control (C2) infrastructure. Instead of relying on conventional web protocols that might be easily flagged, the malware routes operator instructions through RabbitMQ, a widely adopted enterprise messaging system. This technique allows its network traffic to masquerade as legitimate business communications, particularly in environments where RabbitMQ is already in use for routine operations.

For storing task results, BLUERABBIT utilizes Redis. Stolen files are then uploaded to attacker-controlled cloud storage via MinIO, an open-source platform that offers Amazon S3 compatibility. This combination of RabbitMQ, Redis, and MinIO creates a covert, enterprise-like infrastructure that can bypass many traditional security monitoring tools.

Infection Chain and Destructive Payload

Upon initial execution, BLUERABBIT checks a specific Windows registry key to determine if it has run before. For its first execution, it establishes persistence by creating a scheduled task named “OneDrive Update.” This task, designed to mimic a legitimate Microsoft service, restarts every 60 seconds and ensures the malware’s survival across system reboots, making simple process termination ineffective.

The malware offers its operators a variety of destructive options. It can encrypt files across all system drives, appending a “.candy” extension and replacing the user’s desktop wallpaper with an AI-generated alert image. Additionally, BLUERABBIT includes two distinct disk-wiping modules. One module performs a single pass of overwriting drives with random data, while the more destructive option layers zeros, random data, and 0xFF values, making data recovery virtually impossible.

Before initiating any data destruction, BLUERABBIT takes ownership of critical Windows boot files and modifies the registry to disable automatic recovery and system repair functions. This pre-emptive action ensures that once the destructive sequence begins, Windows cannot enter a safe state or attempt any form of self-repair, maximizing the impact of the attack.

What You Should Do

• Monitor for Anomalous Folder Names: Be vigilant for folders resembling Windows GUIDs but containing non-hexadecimal characters (G-Z). Real GUIDs exclusively use hexadecimal characters (0-9, A-F).
• Inspect AMQP Traffic: Endpoint workstations should not typically generate AMQP (Advanced Message Queuing Protocol) traffic. Any such activity should be immediately investigated as a potential BLUERABBIT infection.
• Detect Unexpected MinIO Client Activity: Monitor for instances where the MinIO client is launched by unusual or unexpected parent processes, which could indicate active data exfiltration.
• Alert on Boot File Modifications: Configure alerts for any processes attempting to use takeown or icacls on core Windows boot files outside of documented maintenance windows.
• Implement Robust Backup Strategies: Maintain frequent, isolated, and tested backups to mitigate the impact of both file encryption and disk-wiping attacks.
• Enhance Endpoint Detection and Response (EDR): Utilize EDR solutions to proactively hunt for early-stage indicators of compromise (IoCs) and detect suspicious behaviors before destructive actions occur.

Indicators of Compromise (IoCs):-

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.