Microsoft has taken apart a destructive Windows backdoor it calls GigaWiper. What stands out is how it is built: not one tool but three older destructive programs bolted into one, offered as commands the operator can choose from.
GigaWiper
GigaWiper is a modular Golang malware family for Windows that combines backdoor, surveillance, remote-administration, exfiltration, and destructive capabilities in a single implant.
Profile source: Mallory opens in a new tabGigaWiper
Family profile
GigaWiper is a modular Golang malware family for Windows that combines backdoor, surveillance, remote-administration, exfiltration, and destructive capabilities in a single implant. It has been described as a post-compromise intrusion platform that allows operators to maintain access, conduct reconnaissance and monitoring, and then trigger irreversible system destruction on demand.
Observed functionality includes persistence via a scheduled task masquerading as a legitimate OneDrive updater, command-and-control using RabbitMQ for tasking and Redis for status and output, PowerShell execution, process and service management, registry modification, system profiling, screenshot capture, continuous screen recording, event-log clearing, file upload, and a VNC-like hidden remote-control capability with keyboard and mouse interaction. The malware also modifies Windows Firewall rules to support its remote-access channel.
GigaWiper incorporates multiple destructive modules. These include a raw physical-disk wiper that overwrites disk content and damages partition information, a Windows-drive secure wiper that performs multi-pass overwrites, and a faux-ransomware routine derived from Crucio that encrypts files with randomly generated keys that are intentionally not retained, making recovery impossible and indicating destructive rather than extortion intent. Microsoft also linked another destructive component to FlockWiper, assessing that GigaWiper consolidates functionality from at least three previously separate malware families into one framework.
The malware was first observed in destructive activity in October 2025. Reporting consistently characterizes it as a Windows-focused implant used after initial access has already been obtained. Some external reporting has associated overlapping tooling tracked as BlueRabbit or BLUERABBIT with Iran-linked activity targeting Israeli organizations, but definitive attribution for GigaWiper itself has not been publicly confirmed. Technical overlap with Zebrocy has also been noted in some samples, but available information is insufficient to support firm attribution on that basis.
Capabilities
- Defense Evasion
- Exfiltration
- Persistence
- Post Exploitation
- Process Injection
- Reconnaissance
Reported operators
Threat actors
1 named in public reportingMITRE ATT&CK
GigaWiper in ATT&CK
37 distinct techniquesTechniques
37 techniques T1057 Process Discovery T1113 Screen Capture T1082 System Information Discovery T1486 Data Encrypted for Impact T1561.001 Disk Content Wipe T1007 System Service Discovery T1053 Scheduled Task/Job T1562.004 Disable or Modify System Firewall T1112 Modify Registry T1070.001 Clear Windows Event Logs T1561.002 Disk Structure Wipe T1071 Application Layer Protocol T1219 Remote Access Tools T1105 Ingress Tool Transfer T1059.001 PowerShell T1485 Data Destruction T1053.005 Scheduled Task T1070 Indicator Removal T1078 Valid Accounts T1036 Masquerading T1489 Service Stop T1056.001 Keylogging T1567.002 Exfiltration to Cloud Storage T1021.005 VNC T1490 Inhibit System Recovery T1083 File and Directory Discovery T1059 Command and Scripting Interpreter T1021.001 Remote Desktop Protocol T1529 System Shutdown/Reboot T1125 Video Capture T1562 Impair Defenses T1543.003 Windows Service T1047 Windows Management Instrumentation T1070.004 File Deletion T1012 Query Registry T1059.003 Windows Command Shell T1561 Disk Wipe
