GRAYRABBITMalware
According to Mandiant, GRAYRABBIT is a lightweight and simple backdoor that supports simple file operation, system information collection, running modularized plugins, and executing a remote command shell.From MISP Galaxy
Last reported 12 days ago, by Recorded Future2 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1553.002Code Signing
“One of campaigns leverage stolen code-signing certificates Cobalt Strike payloads, and exploits (CVE-2020-16040) hosted across multiple C&C domains and IP addresses to maintain persistent access.”
- T1684Social Engineering
“Scripts for social engineering pop-ups designed to deceive victims into downloading and executing malicious files.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
September 2026 CVE Landscape“September reporting linked NightEagle and UNC3569 to GhostContainer and GRAYRABBIT deployments, while Cisco FMC exploitation by three threat clusters led to credential theft, Cyclops Blink deployment, and Qilin ransomware.”
-
PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups“In the case of SHADOW-VOID-044, we noticed the GRAYRABBIT backdoor (previously reported to be utilized by UNC3569) was hosted on a server (47.238.219.111) operated by this campaign.”
Indicators in its reports
named in the reports above- 47.238.219[.]111in 1 report
Copy this indicator · defanged
Thanks — we review every report.