Executive Summary
BLUERABBIT is a sophisticated Golang-based backdoor attributed to a likely Iran-nexus threat actor, first observed in early 2026 targeting entities in Israel. The malware is characterized by its modular design, combining remote access, extensive system profiling, and data exfiltration with destructive capabilities, including file encryption (.candy extension) and multi-pass disk wiping.
The threat actor utilizes enterprise-grade infrastructure for Command and Control (C2), specifically RabbitMQ (AMQP) for tasking, Redis for state management, and MinIO (S3) for data exfiltration. This architecture allows the malware to blend in with legitimate message broker and cloud storage traffic. The campaign appears related to a cluster previously identified using BLUEWIPE and SEWERGOO tools, indicating a persistent and evolving threat focused on high-impact disruptive operations.