Loading story…
Microsoft disclosed a destructive Go-based Windows backdoor dubbed GigaWiper that has been observed in compromised environments since October 2025, combining espionage, remote access, and sabotage functions in a single modular implant. The malware supports about 20 command codes and can wipe physical disks, overwrite the Windows drive, trigger BSOD-based disruption, clear event logs, manipulate processes, services, and the registry, capture screenshots, record screens, and provide hidden VNC-like remote control. It also masquerades as OneDrive and uses RabbitMQ, Redis, and in some reporting MinIO for command, result handling, and data exfiltration.
Microsoft said GigaWiper appears to be assembled from at least three malware families, with code overlaps linking it to Crucio and FlockWiper and references to a broader framework labeled GRAT. One destructive component mimics ransomware by encrypting files without preserving a recovery key, making restoration impossible except from clean backups, while another performs multi-pass secure wiping. Separate reporting said the same hashes and command-and-control infrastructure matched Binary Defense's earlier BLUERABBIT findings, and cited broader research associating related tooling with likely Iran-linked operations targeting Israeli organizations, though Microsoft did not publicly attribute the activity to a country.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft published a technical analysis of GigaWiper, describing code links to Crucio and FlockWiper, its use of RabbitMQ and Redis infrastructure, and capabilities including disk wiping, fake ransomware-style irreversible encryption, log clearing, screenshots, screen recording, and VNC-like remote control. The company also released indicators of compromise, including SHA-256 hashes, command-and-control IP addresses, Defender detections, and mitigation guidance.
Microsoft Threat Intelligence said it first observed the destructive Golang-based backdoor GigaWiper in compromised environments beginning in October 2025. The malware combined command-and-control, persistence, espionage-style functions, and multiple destructive payloads in a single modular implant.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
15 references tracked. Mallory keeps watching after this page renders.
blog.polyswarm.io
Open sourcesecurityonline.info
Open sourcexakep.ru
Open sourcedarkreading.com
Open sourcehackread.com
Open sourcetrojan-killer.net
Open sourcethehackernews.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Binary Defense disclosed a newly identified Go-based Windows backdoor, **BLUERABBIT**, that provides attackers with persistent access, reconnaissance, screenshot and screen-recording capture, shell execution, and data theft before escalating to file encryption and destructive wiping. The malware is assessed as likely tied to an **Iran-nexus** activity cluster and appears primarily aimed at organizations in **Israel**. Researchers said BLUERABBIT was first observed in mid-to-late March 2026 and linked it to activity associated with **BLUEWIPE** and **SEWERGOO**. BLUERABBIT blends into enterprise environments by using **RabbitMQ** over **AMQP** for command-and-control, **Redis** for task state management, and **MinIO** for S3-compatible exfiltration. It persists through a scheduled task named **"OneDrive Update"**, stores staging data under `HKCU\Software\OneDrive`, can encrypt files with the `.candy` extension, and includes two wiping routines that disable Windows recovery mechanisms and alter boot-file permissions to make systems unrecoverable. Detection opportunities include anomalous AMQP traffic from workstations, suspicious MinIO client execution, unusual GUID-like staging folders, the fake OneDrive task, and unauthorized use of tools such as `takeown` or `icacls` against critical boot files.
Jun 29, 2026
Multiple destructive malware campaigns struck Ukraine around the start of Russia’s invasion, with **HermeticWiper**, **IsaacWiper**, **CaddyWiper**, **WhisperGate**, and **DoubleZero** used against government, financial, and other organizations. Researchers reported that HermeticWiper corrupted boot records and partition data by abusing a legitimate EaseUS driver, while CaddyWiper and DoubleZero erased user data, partition information, and critical registry or boot components, often while deliberately sparing domain controllers to preserve attacker access. Several incidents appeared to follow prior compromise of victim networks, including abuse of **Active Directory**, scheduled execution, and in some cases worm-like spread via **HermeticWizard**; HermeticRansom was also deployed as a likely decoy alongside destructive activity. The destructive operations extended beyond enterprise Windows environments. **AcidRain** was used in the attack on Viasat’s **KA-SAT** network, wiping satellite modems in Ukraine and elsewhere in Europe by recursively destroying filesystems and storage devices, while the **Industroyer2** operation targeted a Ukrainian energy provider with malware built to communicate over **IEC-104** and cut power, paired with Windows, Linux, and Solaris wipers including **CaddyWiper**, **ORCSHRED**, **SOLOSHRED**, and **AWFULSHRED**. Across the reporting, defenders were urged to watch for mass file overwrites, shadow copy and event log deletion, MBR or partition changes, suspicious use of administrative tooling and group policy, and to maintain tested, isolated backups to recover from destructive attacks.
Aug 15, 2026
Researchers reported that **HermeticWiper** was deployed in destructive intrusions targeting Windows environments, alongside broader disruptive activity that included DDoS attacks, website defacements, mobile device management abuse, Microsoft SQL attacks, and a ransomware decoy. The malware was observed using a legitimately signed **EaseUS Partition Master** driver to gain low-level access to storage devices, then corrupting the **MBR**, boot sectors, and **NTFS** structures to make systems unbootable and unrecoverable. Analysis indicates the campaign may have spread through **Group Policy Object (GPO)** deployment after initial access via exposed services or spear phishing, with operators also using web shells, `schtasks`, and PowerShell for persistence and privilege escalation. HermeticWiper additionally disabled crash dumps and protections tied to **Volume Shadow Copy**, while a related Golang ransomware component, tracked as **HermeticRansom** or **PartyTicket**, encrypted files with the `.encryptedJB` extension and dropped a `read_me.html` ransom note; security vendors said a decryptor for that ransomware component was available.
Aug 15, 2026