Executive Summary
ReliaQuest has identified 'Gryxa,' a new toolkit used by financially motivated threat actors that appears to have been substantially developed with commercial AI coding agents. The malware has been observed across 324 hosts, using AI-assisted code to manage everything from individual components to a fleet management console. This represents a significant shift where a single operator can maintain infrastructure previously requiring a full team by utilizing jailbroken AI models to bypass development safeguards.
Gryxa is notably resilient, employing seven scheduled tasks, WMI event subscriptions, and hidden file caches to rebuild itself if partially removed. Most critically, the toolkit monitors its own removal; if a defender deletes the primary RMM implant, a secondary component collects and exfiltrates the forensic logs of the remediation process back to the attacker. If the actor's relay infrastructure becomes unreachable for over 10 minutes, the malware triggers countermeasures to actively disable or uninstall endpoint protection agents.
The business impact is high due to the toolkit's focus on stealing cryptocurrency wallets and Chromium-based browser credentials. Because the malware can observe and adapt to defender actions, organizations must follow a strict containment order—blocking network infrastructure before attempting host-based removal—to prevent the toolkit from fighting back and disabling security controls.