Kiran 
A financially motivated threat actor has done something ReliaQuest’s Threat Research team has never documented before: built a complete, multi-component attack toolkit malware, a persistence engine, a credential stealer, and a fleet-management console almost entirely with help from a commercial AI coding agent.
The toolkit, dubbed “Gryxa,” is currently active on 324 listed hosts, 69 of which were online at the time of ReliaQuest’s analysis.
ReliaQuest assessed with high confidence that Gryxa was developed with substantial AI assistance after finding a commercial AI coding agent listed as co-author on the majority of commits in the actor’s public code repository.
Gryxa Malware
The repository also contained engineering “rules” files fed to the AI in every session, plus 35 numbered write-ups documenting the actor’s own failed deployments followed by commits that fixed exactly those problems. That pattern points to a genuine iterative build process, not a one-shot AI output.
Two scripts even carried a false justification header: “Authorized internal deployment – lab/competition scope only,” despite performing persistence and monitoring functions with no legitimate use. ReliaQuest believes this framing may have been enough to get the AI agent to cooperate on malicious code.
Gryxa hijacks legitimate remote monitoring and management (RMM) software for covert access, then buries itself across four hidden directories disguised as Windows diagnostic paths.
Its persistence layer includes at least seven scheduled tasks split across two independent tiers, a permanent WMI event subscription, and an off-path backup copy of its own files, meaning deleting one component barely slows it down, since the others simply rebuild it within a minute.
Perhaps the most dangerous behavior: if Gryxa’s connection to the attacker’s relay drops, it treats that silence as a signal to counterattack.
Within roughly 10–13 minutes, it disables Microsoft Defender, force-stops known EDR agents, and attempts a silent uninstall of endpoint protection using registry-stored uninstall strings, then quietly re-enables Defender once contact resumes, erasing the obvious warning sign.
The toolkit’s credential module targets Chromium-based browsers, using three techniques to bypass Chrome’s App-Bound Encryption, and checks stolen logins against roughly 40 crypto-exchange domains and 69 cryptocurrency wallet extension IDs. Stolen data flows out through Telegram bots rather than the malware’s own command channel.
Most unusually, once defenders remove the visible RMM implant, a surviving Gryxa component quietly harvests Windows logs, service control records, and process histories that describe exactly how the removal occurred, then uploads that evidence to the attacker, effectively letting them watch and learn from the incident response.
ReliaQuest recommends blocking the actor’s infrastructure before removing any implant components, since cutting the RMM service alone triggers the anti-EDR countermeasure.
Responders should also account for all persistence layers simultaneously, enable “uninstall protection” on endpoint agents, and treat a healthy antivirus status with suspicion, since Gryxa restores Defender upon reconnection.
ReliaQuest expects more single operators to build attacks of this sophistication over the next 12 months, reinforcing the case for behavior-based detection over static indicator tracking.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
