Gryxa, a new type of malware, leaves a component behind that records how security responders removed it, then gives that information to the operator.

 

What happened

Researchers investigating a public code repository and its supporting infrastructure identified a Windows toolkit called Gryxa, with an operator console listing 324 infected hosts and 69 online during the review. Cyber Security News reported on August 31, 2026. Entry appears to come through a phishing message carrying a 19 MB self-extracting file named to look like an invoice. Once run, it pulls the rest of its components over HTTPS and converts legitimate remote monitoring and management software into a covert control channel. Repository records carried AI co-author metadata on most commits, and researchers concluded the toolkit was likely built in large part with a commercial AI coding agent.

 

Going deeper

Removing the visible implant does not end the intrusion, a second component stays behind and begins collecting Windows event logs, scheduled tasks, event subscriptions, installer and service-control records, process-creation history, and an inventory of remote-access tools present on the machine. All of it goes into an archive and back to the operator. What that gives an attacker is a description of the response itself, covering which tools the security team used and which accounts they logged in with. Persistence runs deep enough to make partial cleanup routine rather than exceptional. Researchers found three scheduled tasks under the toolkit's own working directory, four more disguised to resemble Microsoft entries, a permanent Windows Management Instrumentation subscription that survives reboots, and a backup copy of the files stored outside the main folder. Delete the obvious client and the remaining pieces can rebuild the toolkit in roughly a minute.

 

What was said

Cutting the remote-control service alone starts a countdown of about 10 to 13 minutes before endpoint protection is affected, according to the research. A guard component checks the operator's relay every five minutes. Two failed checks trigger an attempt to disable Microsoft Defender and stop other endpoint security products; a third prompts it to pull an uninstall command from the registry and remove the security agent silently. Researchers noted that the toolkit may switch Defender back on when the relay returns while leaving its own exclusions in place, so a healthy status in the console proves nothing about whether the machine is clean.

 

In the know

CISA, the NSA, and the Multi-State Information Sharing and Analysis Center warned network defenders about criminal use of legitimate remote monitoring and management software, recommending that organizations audit which of these tools are installed, require them to run only over approved remote access solutions such as a VPN, and block both inbound and outbound connections on default ports for any that are not authorized. Maintaining a list of what should be there is what converts an unexpected agent into a detectable event. Detection by file hash offers little here, since the operator runs a centralized update process that swaps components whenever they change. Behavior chains are what remain visible: remote management software appearing without a ticket, tasks created at SYSTEM level, WMI subscriptions written, and browser credential stores being read.

 

The big picture

Clinical workstations sit tethered to imaging equipment, laboratory analyzers, and legacy applications that only run on a validated build, so wiping one means coordinating with biomedical engineering and taking a device offline during clinical hours. Partial remediation becomes the default under those constraints, which is the exact condition this toolkit is designed to exploit. Anything short of removing the service, every scheduled task, the WMI subscription, and all working directories in one action leaves it able to restore itself, and the recommended sequence puts blocking the operator's infrastructure at the network edge before any of that. Deploying a fresh remote-access tool onto a live infected machine carries its own risk, since the malware may read it as a competitor and uninstall it. Credential rotation belongs in the same response, because any password saved in a browser profile the malware could reach should be treated as gone, which for clinical staff means EHR portals, payer sites, and laboratory systems.

 

FAQs

Why would attackers want the logs from an incident response?

Knowing which security tools an organization runs, which accounts responders use, and what steps they took tells an operator how to avoid detection on the next attempt. It also identifies privileged accounts worth targeting, since responder credentials usually carry broad access.

 

What is a WMI event subscription and why is it hard to remove?

Windows Management Instrumentation lets administrators trigger actions when specified system events occur. A permanent subscription is stored in the WMI repository rather than as a file or a registry run key, so it survives reboots and cleanup routines that only look in the usual persistence locations.

 

Does antivirus showing green mean a machine is clean?

Not after this kind of compromise. The toolkit can disable protection, add exclusions covering its own directories, then re-enable the product with those exclusions intact. Verifying exclusion lists and protection history matters more than the status indicator.

 

How should an organization decide between cleaning and reimaging?

Reimaging is the reliable option whenever malware has achieved SYSTEM-level persistence across multiple mechanisms. Cleaning is defensible only when responders can enumerate every component with confidence, and the presence of backup copies stored outside the main installation folder makes that difficult here.

 

What does auditing remote management tools involve?

Building a list of which products are approved, which teams use them, and where they are installed, then alerting on any agent outside that list. Most organizations discover during the exercise that several unauthorized tools are already running, installed by departments or vendors without security review.