Loading story…
Microsoft disclosed a destructive Go-based Windows backdoor dubbed GigaWiper that has been observed in compromised environments since October 2025, combining espionage, remote access, and sabotage functions in a single modular implant. The malware supports about 20 command codes and can wipe physical disks, overwrite the Windows drive, trigger BSOD-based disruption, clear event logs, manipulate processes, services, and the registry, capture screenshots, record screens, and provide hidden VNC-like remote control. It also masquerades as OneDrive and uses RabbitMQ, Redis, and in some reporting MinIO for command, result handling, and data exfiltration.
Microsoft said GigaWiper appears to be assembled from at least three malware families, with code overlaps linking it to Crucio and FlockWiper and references to a broader framework labeled GRAT. One destructive component mimics ransomware by encrypting files without preserving a recovery key, making restoration impossible except from clean backups, while another performs multi-pass secure wiping. Separate reporting said the same hashes and command-and-control infrastructure matched Binary Defense's earlier BLUERABBIT findings, and cited broader research associating related tooling with likely Iran-linked operations targeting Israeli organizations, though Microsoft did not publicly attribute the activity to a country.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft published a technical analysis of GigaWiper, describing code links to Crucio and FlockWiper, its use of RabbitMQ and Redis infrastructure, and capabilities including disk wiping, fake ransomware-style irreversible encryption, log clearing, screenshots, screen recording, and VNC-like remote control. The company also released indicators of compromise, including SHA-256 hashes, command-and-control IP addresses, Defender detections, and mitigation guidance.
Microsoft Threat Intelligence said it first observed the destructive Golang-based backdoor GigaWiper in compromised environments beginning in October 2025. The malware combined command-and-control, persistence, espionage-style functions, and multiple destructive payloads in a single modular implant.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
malwarebytes.com
Open sourcesecurityweek.com
Open sourcecybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourcehackread.com
Open sourcetrojan-killer.net
Open sourcethehackernews.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Binary Defense disclosed a newly identified Go-based Windows backdoor, **BLUERABBIT**, that provides attackers with persistent access, reconnaissance, screenshot and screen-recording capture, shell execution, and data theft before escalating to file encryption and destructive wiping. The malware is assessed as likely tied to an **Iran-nexus** activity cluster and appears primarily aimed at organizations in **Israel**. Researchers said BLUERABBIT was first observed in mid-to-late March 2026 and linked it to activity associated with **BLUEWIPE** and **SEWERGOO**. BLUERABBIT blends into enterprise environments by using **RabbitMQ** over **AMQP** for command-and-control, **Redis** for task state management, and **MinIO** for S3-compatible exfiltration. It persists through a scheduled task named **"OneDrive Update"**, stores staging data under `HKCU\Software\OneDrive`, can encrypt files with the `.candy` extension, and includes two wiping routines that disable Windows recovery mechanisms and alter boot-file permissions to make systems unrecoverable. Detection opportunities include anomalous AMQP traffic from workstations, suspicious MinIO client execution, unusual GUID-like staging folders, the fake OneDrive task, and unauthorized use of tools such as `takeown` or `icacls` against critical boot files.
Jun 29, 2026
Researchers reported that systems hit by **HermeticWiper** were also presented with a fake ransomware operation dubbed **GoRansom**, but the ransom component appeared to be a distraction rather than a genuine extortion campaign. The attack combined destructive wiping activity with a ransom note, creating the appearance of financially motivated malware while the underlying objective was irreversible system damage. Analysis linked the incident to the broader **HermeticWiper** intrusion set, indicating that the so-called GoRansom element lacked the hallmarks of a normal ransomware deployment and instead served as cover for sabotage. The operation highlighted how threat actors can blend wiper malware with counterfeit ransom messaging to delay attribution, confuse responders, and mask a destructive attack as ordinary cybercrime.
Jul 10, 2026
Trellix disclosed **PathWiper**, a destructive malware operation that abuses **DCOM** to move across Windows environments and trigger large-scale disk wiping. The activity was presented as a network erasure campaign rather than conventional ransomware, with the malware designed to render systems inoperable by corrupting or destroying data across affected hosts. The report highlights the use of legitimate Windows remote management mechanisms to propagate the wiper, underscoring how trusted administrative features can be turned into destructive tradecraft. For defenders, the findings point to the need for tighter controls on **DCOM** usage, stronger monitoring of lateral movement through native Windows components, and rapid containment of suspicious remote execution activity before wiping actions spread across the network.
Jul 10, 2026