Gryxa: The AI-Built Toolkit That Watches How You Remove It

ReliaQuest reports Gryxa, a new toolkit used by a financially motivated threat actor to maintain access across 324 listed hosts, and assesses that much of it was built with a commercial AI coding agent. The toolkit uses RMM abuse, layered persistence, credential theft, and response-aware countermeasures, while collecting Windows logs and host artifacts after defenders try to remove it. #Gryxa #ReliaQuest #Chromium #MicrosoftDefender #Telegram

Keypoints

ReliaQuest identified a new toolkit called Gryxa, used by a financially motivated actor across 324 listed hosts, with 69 online at analysis time.
Most repository commits showed AI co-author metadata, leading ReliaQuest to assess that substantial parts of Gryxa were built with a commercial AI coding agent.
Gryxa abuses legitimate RMM software for covert access, maintains persistence through multiple scheduled tasks and a WMI event subscription, and can recover after partial removal.
When the actor’s relay becomes unreachable, Gryxa escalates by disabling or uninstalling endpoint protection within about 10–13 minutes.
The toolkit steals credentials from Chromium-based browsers, including data tied to cryptocurrency exchanges and wallet-related browser extensions.
After defenders remove the visible RMM implant, a surviving component gathers Windows logs, service and installer records, process activity, and remote-access tool inventory, then uploads them to actor-controlled infrastructure.
ReliaQuest advises blocking the actor’s infrastructure first, then removing all persistence mechanisms in one pass to avoid triggering countermeasures.

MITRE Techniques

[T1566 ] Phishing – The toolkit was likely delivered through a phishing attachment with an invoice-themed filename (‘likely delivered via phishing … invoice_.exe’).
[T1204 ] User Execution – A self-extracting executable was likely opened by the victim to start the infection chain (‘self-extracting executable’).
[T1105 ] Ingress Tool Transfer – Components were downloaded over HTTPS from actor infrastructure or a code-hosting service (‘The installer retrieves the remaining components over HTTPS’).
[T1027 ] Obfuscated Files or Information – The toolkit hid files in multiple disguised directories and used hidden attributes to reduce visibility (‘All are marked hidden’).
[T1053.005 ] Scheduled Task/Job: Scheduled Task – Gryxa used multiple scheduled tasks for persistence and rapid restoration (‘Three WinRTCS scheduled tasks … at one-, five- and fifteen-minute intervals’).
[T1546.003 ] Event Triggered Execution: WMI Event Subscription – A permanent WMI subscription survived reboots and helped restore the toolkit (‘A permanent WMI event subscription’).
[T1547.001 ] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – The toolkit included startup-style persistence across system start and user logon (‘one triggers at system start, and one at user logon’).
[T1014 ] Rootkit – The toolkit used a WMI watchdog and service repair mechanisms to preserve persistence and conceal or restore execution (‘WMI watchdog, and service repair for the persistence layer’).
[T1112 ] Modify Registry – The actor read uninstall strings from the registry and wrote policy/exclusion settings for Defender (‘reads the uninstall string … from the registry’).
[T1562.001 ] Impair Defenses: Disable or Modify Tools – Gryxa disabled Microsoft Defender and attempted to uninstall EDR products when contact was lost (‘disables Microsoft Defender’).
[T1555.003 ] Credentials from Web Browsers – The credential module targeted saved Chromium browser credentials (‘steals credentials saved in Chromium-based browsers’).
[T1552.001 ] Unsecured Credentials: Credentials In Files – Decrypted browser-stored credentials and plaintext outputs were exfiltrated (‘Credentials leave the host through Telegram … sent as plaintext’).
[T1021.001 ] Remote Services: Remote Desktop Protocol – The toolkit maintained remote-access-style control through an RMM implant and console-managed sessions (‘run an initial-access operation’).
[T1071.001 ] Application Layer Protocol: Web Protocols – The actor used HTTPS for downloads and authenticated uploads to communicate with infrastructure (‘retrieves the remaining components over HTTPS’).
[T1102.003 ] Web Service: Relay – The actor’s relay infrastructure and fallback hosting were used to deliver components and manage the fleet (‘their relay infrastructure serves near-identical landing pages’).

Indicators of Compromise

[File names ] Likely delivery artifact and repository scripts – invoice_.exe, own_lib.ps1, and own_mon.cmd
[Directory names ] Hidden persistence and staging locations – WinRTCS, Windows error reporting and diagnostics-style folders, and an off-path backup copy directory
[Host counts ] Actor fleet management console – 324 listed hosts, 69 reporting online
[Document names ] Repository guidance and operator notes – SESSION_HANDOFF.md, CASES.md, and collect-forensics
[Telemetry/log artifacts ] Collected during post-removal response capture – scheduled tasks, Windows event subscriptions, installer logs, service-control logs, and process-creation logs
[Network/transport ] Delivery and exfiltration channels – HTTPS, Telegram, and actor-controlled relay infrastructure
[Software/targets ] Protected products and platforms referenced in behavior – Microsoft Defender, Chromium-based browsers, and browser wallet extensions

SHARE THIS STORY

WhatsApp X (Twitter)Telegram Bluesky Facebook LinkedIn Threads Email Print