Microsoft has taken apart a destructive Windows backdoor it calls GigaWiper. What stands out is how it is built: not one tool but three older destructive programs bolted into one, offered as commands the operator can choose from.
GigaWiper
GigaWiper is a modular Golang-based Windows backdoor that combines espionage-oriented remote administration with multiple destructive payloads in a single implant.
Profile source: Mallory opens in a new tabGigaWiper
Family profile
GigaWiper is a modular Golang-based Windows backdoor that combines espionage-oriented remote administration with multiple destructive payloads in a single implant. It was first observed in destructive intrusions in October 2025 and is designed for post-compromise use, allowing operators to maintain access, conduct surveillance and system management, exfiltrate files, and then trigger irreversible sabotage on demand.
The malware supports persistence by masquerading as a OneDrive-related component and creating a recurring scheduled task. Its command-and-control architecture uses RabbitMQ for tasking and Redis for status and output handling, and observed functionality also includes file upload to remote storage. GigaWiper exposes a broad command set for PowerShell execution, system reconnaissance, antivirus discovery, process and service management, registry modification, screenshot capture, continuous screen recording, event log clearing, and hidden VNC-like remote desktop control with keyboard and mouse input. It also modifies firewall settings to enable remote-access functionality.
GigaWiper is notable for consolidating functionality from at least three previously separate malware families into one operator-selectable framework. Microsoft linked one destructive module to Crucio-derived code that performs fake-ransomware-style encryption using randomly generated keys that are intentionally not retained, rendering affected files unrecoverable and indicating destructive rather than extortion intent. Another destructive component is a Go reimplementation of FlockWiper-style multi-pass wiping logic. Additional destructive routines include raw physical-disk wiping, partition metadata destruction, Windows-drive overwriting, boot-disruption and recovery disabling, and forced system restart or crash behavior intended to leave systems unusable.
This design reflects an evolution from single-purpose wipers toward unified intrusion platforms that support prolonged covert access before switching to destructive action. Public reporting has noted overlap with malware also tracked as BlueRabbit or BLUERABBIT, and some reporting has discussed possible Iran-linked associations, but no definitive public attribution has been confirmed. GigaWiper should be treated as both a backdoor and a destructive malware platform capable of surveillance, remote control, file theft, defense evasion, and irreversible system damage across compromised Windows environments.
Capabilities
- Defense Evasion
- Exfiltration
- Persistence
- Post Exploitation
- Process Injection
- Reconnaissance
Reported operators
Threat actors
1 named in public reportingMITRE ATT&CK
GigaWiper in ATT&CK
37 distinct techniquesTechniques
37 techniques T1561.001 Disk Content Wipe T1105 Ingress Tool Transfer T1561 Disk Wipe T1490 Inhibit System Recovery T1486 Data Encrypted for Impact T1057 Process Discovery T1113 Screen Capture T1082 System Information Discovery T1007 System Service Discovery T1053 Scheduled Task/Job T1562.004 Disable or Modify System Firewall T1112 Modify Registry T1070.001 Clear Windows Event Logs T1561.002 Disk Structure Wipe T1071 Application Layer Protocol T1219 Remote Access Tools T1059.001 PowerShell T1485 Data Destruction T1053.005 Scheduled Task T1070 Indicator Removal T1078 Valid Accounts T1036 Masquerading T1489 Service Stop T1056.001 Keylogging T1567.002 Exfiltration to Cloud Storage T1021.005 VNC T1083 File and Directory Discovery T1059 Command and Scripting Interpreter T1021.001 Remote Desktop Protocol T1529 System Shutdown/Reboot T1125 Video Capture T1562 Impair Defenses T1543.003 Windows Service T1047 Windows Management Instrumentation T1070.004 File Deletion T1012 Query Registry T1059.003 Windows Command Shell
