GigaWiper Backdoor Combines Disk Wiping, Fake Ransomware, and Spyware

Microsoft disclosed a destructive Go-based Windows backdoor dubbed GigaWiper that has been observed in compromised environments since October 2025, combining espionage, remote access, and sabotage functions in a single modular implant. The malware supports about 20 command codes and can wipe physical disks, overwrite the Windows drive, trigger BSOD-based disruption, clear event logs, manipulate processes, services, and the registry, capture screenshots, record screens, and provide hidden VNC-like remote control. It also masquerades as OneDrive and uses RabbitMQ, Redis, and in some reporting MinIO for command, result handling, and data exfiltration.

Microsoft said GigaWiper appears to be assembled from at least three malware families, with code overlaps linking it to Crucio and FlockWiper and references to a broader framework labeled GRAT. One destructive component mimics ransomware by encrypting files without preserving a recovery key, making restoration impossible except from clean backups, while another performs multi-pass secure wiping. Separate reporting said the same hashes and command-and-control infrastructure matched Binary Defense's earlier BLUERABBIT findings, and cited broader research associating related tooling with likely Iran-linked operations targeting Israeli organizations, though Microsoft did not publicly attribute the activity to a country.