EXECUTIVE SUMMARY
BLUERABBIT is a highly capable Golang-based backdoor that combines espionage, data exfiltration, file encryption, and destructive capabilities. The malware can establish persistent access to compromised Windows systems, collect sensitive information, and execute commands received from attacker-controlled infrastructure. Researchers have also observed functionality enabling file encryption and disk-wiping operations, potentially causing significant operational disruption and impacting system recovery efforts.
- Threat Name: BLUERABBIT
- Threat Type: Backdoor with Data Exfiltration, File Encryption, and Destructive Capabilities
- Active Region: Primarily Israel and the Middle East
- Affected Sector: Government, critical infrastructure, telecommunications, financial services, and other organizations operating Windows environments
- Affected Platform: Microsoft Windows
- Severity: Critical
- Published Date: June 11,2026
TECHNICAL DETAILS
BLUERABBIT is a Golang-based backdoor that combines remote access, system reconnaissance, data exfiltration, file encryption, and disk-wiping capabilities. The malware uses RabbitMQ (AMQP) for command-and-control communications, Redis for task management, and MinIO for data exfiltration. It can encrypt files by appending the “.candy” extension and includes features designed to disrupt system recovery.
- Execution and Persistence: Upon execution, BLUERABBIT checks the HKCU\Software\OneDrive\Environment registry key for evidence of prior execution. It establishes persistence by creating a hidden scheduled task named “OneDrive Update”, configured to run at system startup with the highest available privileges and automatically restart if terminated
- Command-and-Control and Data Exfiltration: The malware communicates with attacker-controlled infrastructure through RabbitMQ (AMQP), manages operational states using Redis, and utilizes MinIO for staging and…….
