Hackers Use BLUERABBIT Backdoor to Encrypt Files and Wipe Disks Across Windows Systems

Cybersecuritynews •Tushar Subhra Dutta • June 11, 2026

A newly discovered backdoor called BLUERABBIT has been found targeting Windows systems with a dangerous mix of file encryption, disk wiping, and data theft. First observed in mid-to-late March 2026, the malware is believed to be the work of a threat actor with ties to Iran, and its primary targets appear to be organizations based […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

BLUERABBIT Backdoor Targets Windows Systems with Encryption and Wiping Capabilities The BLUERABBIT backdoor, a Golang-based malware, has been identified targeting Windows systems since March 2026. It combines data theft, file encryption, and destructive disk wiping, primarily affecting Israeli entities. The malware is believed to be linked to Iranian threat actors. BLUERABBIT encrypts files with a .candy extension and exfiltrates data to cloud storage controlled by attackers. The attack vector includes remote access and system profiling. Organizations are urged to strengthen their defenses against this sophisticated threat. The current status indicates ongoing investigations and heightened awareness among cybersecurity professionals. 2 sources 75

Extracted Entities

Hackers Use BLUERABBIT Backdoor to Encrypt Files and Wipe Disks Across Windows Systems

The full story

Extracted Entities

Attack Types (1)

Countries (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)