GigaWiper: New Windows Backdoor Pairs Disk Wiping With Spyware

Microsoft has dissected a destructive Windows backdoor dubbed GigaWiper, a Go-based implant that bundles three distinct destructive payloads into a single command-driven toolkit. The malware, also tracked as BLUERABBIT by Binary Defense, shares identical hashes and command-and-control infrastructure across both vendors' reports, with Binary Defense linking the operation to an Iran-nexus threat actor targeting Israeli organizations based on Google Threat Intelligence Group research. Microsoft declined to attribute a country of origin. Because GigaWiper is post-exploitation malware rather than an exploit, there is no patch to deploy; defenders must rely on early detection and verifiable offline backups to survive an infection.

The implant offers operators three flavors of destruction selectable via numbered commands. The first is a raw disk wiper that overwrites the physical drive and shreds the partition table before forcing a reboot, leaving no file-level artifacts to recover. The second is fake ransomware built on legacy code called Crucio, which encrypts user files with a .candy extension and replaces the desktop wallpaper with a ransom-style warning image, but never stores the decryption key and drops no ransom note, making recovery impossible by design. The third targets the Windows drive directly, overwriting it multiple times with varied data patterns and is described by Microsoft as a Go rewrite of its FlockWiper wiper. Security teams can validate exposed services and outbound network paths using a port scanner to identify unexpected listeners that may indicate C2 callbacks.

Beyond destruction, GigaWiper functions as a full surveillance platform. It captures screenshots from every connected monitor, records active sessions, and opens a hidden VNC channel that streams the desktop while letting the operator control input devices. Additional capabilities include enumerating system details, managing processes and services, modifying the registry, and clearing Windows event logs to erase forensic evidence. Microsoft also identified dormant stubs for a keylogger and additional wipers not yet activated in observed samples. Persistence is maintained through a scheduled task disguised as "OneDrive Update" that executes every minute, with the malware registering itself under HKCU\SOFTWARE\OneDrive\Environment to blend into legitimate Microsoft telemetry.

Defending against GigaWiper requires shifting focus from perimeter patching to detection engineering and recovery readiness. Organizations should baseline outbound traffic and inspect TLS certificates on command-server communications with an SSL/TLS checker, monitor for anomalous scheduled tasks impersonating trusted software, and ensure event-log forwarding is enabled to a hardened SIEM so attackers cannot simply wipe their traces. Because no decryption key exists for the fake-ransomware component, immutable, air-gapped backups remain the only viable recovery path. Operators should also run a VPN/proxy detector to confirm whether endpoint traffic is being routed through anonymizing infrastructure that could mask C2 destinations, and audit OneDrive-related registry keys for unauthorized entries as part of routine compromise assessments.