BLUERABBIT Backdoor Encrypts Files, Wipes Windows Systems

Gbhackers •Mayura Kathir • June 11, 2026

A new Golang-based backdoor dubbed BLUERABBIT has been observed performing combined data theft, file encryption and destructive disk wiping against Windows hosts. First seen in mid-to-late March 2026 and suspected to target Israeli entities, BLUERABBIT implements a full-spectrum intrusion framework: remote access, system profiling, exfiltration to attacker-controlled cloud storage, file encryption that appends a .candy […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

BLUERABBIT Backdoor Targets Windows Systems with Encryption and Wiping Capabilities The BLUERABBIT backdoor, a Golang-based malware, has been identified targeting Windows systems since March 2026. It combines data theft, file encryption, and destructive disk wiping, primarily affecting Israeli entities. The malware is believed to be linked to Iranian threat actors. BLUERABBIT encrypts files with a .candy extension and exfiltrates data to cloud storage controlled by attackers. The attack vector includes remote access and system profiling. Organizations are urged to strengthen their defenses against this sophisticated threat. The current status indicates ongoing investigations and heightened awareness among cybersecurity professionals. 2 sources 75

Extracted Entities

BLUERABBIT Backdoor Encrypts Files, Wipes Windows Systems

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)