BLUERABBIT Backdoor Activity

Ankit Mehta@Secvyn

•updated Jun 15, 2026•2•0•5

This rule detects network connections to common messaging and data store ports (RabbitMQ, Redis, MinIO) initiated by PowerShell, redis-cli, or minio.exe, where the process command line also contains the string "encrypt". This combination suggests potential malicious activity such as data encryption by ransomware or other malware targeting these services.