BLUERABBIT Backdoor Targets Windows Systems with Encryption and Wiping Capabilities

BLUERABBIT is a Golang-based backdoor observed since March 2026 targeting Windows systems—primarily Israeli organizations—capable of data exfiltration, encrypting files with a .candy extension, and performing destructive disk wiping; activity is attributed to Iranian-linked actors, uses remote-access and system-profiling vectors, exfiltrates to attacker-controlled cloud storage, and is currently under investigation, prompting heightened defensive measures.