Destructive Windows backdoor stuffs multiple wipers and ransomware code into a single package

1. Executive summary

Microsoft Threat Intelligence has published detailed analysis of GigaWiper, a Golang-based modular Windows backdoor first observed in compromised environments in October 2025. The implant merges at least three previously separate malware families — Crucio ransomware, a Go reimplementation of FlockWiper, and a standalone disk wiper — into a single framework offering ~20 commands spanning remote access, espionage, and irreversible data destruction. GigaWiper establishes persistence via a scheduled task and uses RabbitMQ over AMQP for C2, with Redis for command-status reporting. No CISA-KEV exploitation state, CVSS score, or CVE is associated with this item; no specific threat-actor attribution has been confirmed by MITRE, and Microsoft has not disclosed the scale or scope of victim organisations. For EMEA financial services, the bottom-line risk is catastrophic and irreversible data loss on Windows endpoints and servers following an intrusion, combined with espionage capabilities (screen capture, remote control) that enable data collection prior to destruction.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain

1. Initial compromise — GigaWiper is deployed after attackers have already gained access to a system. The initial access vector is not specified in the source material. Microsoft has not disclosed how systems were compromised.
2. Persistence — The backdoor creates a Windows scheduled task named OneDrive Update that runs every minute and at system startup to maintain persistence.
3. C2 establishment — GigaWiper establishes command-and-control communication using RabbitMQ over AMQP for receiving commands from the C2 server, and Redis for updating command status and output.
4. Reconnaissance and espionage — The implant collects system information including hardware, operating system, network, firmware, user, and antivirus details. It performs continuous screen recording and screenshot capture. It supports VNC-like remote control including keyboard and mouse control.
5. System management — GigaWiper includes process, service, and registry managers: it can create, list, or kill processes; manage Windows services; and navigate and mutate registry keys. It runs PowerShell commands and clears Windows event logs.
6. Data exfiltration — A command uses MinIO Client (mc) to upload stolen files to remote storage.
7. Destruction execution — On operator command, GigaWiper executes one of several destructive payloads (detailed below).

Malware architecture and payload detail

GigaWiper is distributed as unstripped portable executable (PE) files written in Golang. Two sample types have been identified:

• Sample 1 — Standalone wiper: Operates at the physical disk level rather than deleting individual files. It enumerates physical disks via WMI, identifies the Windows installation drive via main.FindWindowsDrive (e.g., \\.\PHYSICALDRIVE0), removes partition references on non-Windows drives using DeviceIoControl with IOCTL_DISK_CREATE_DISK (reinitialising partitioning metadata), and overwrites raw disk content via main.writeRandToDrive in chunks of 0xA00000 bytes. The first byte of each buffer is randomised using crypto/rand.Read; remaining bytes are zero-filled. If random generation fails, the byte value 1 is used instead. On success, the malware prints "Partitions removed successfully." to the console. After wiping, it forces an immediate reboot via Windows shutdown with restart and zero-delay options.
• Sample 2 — Full backdoor: Contains the same wiper functionality (implemented as rabbit_tools_tool_wipe_main.WipeMain) plus ~20 commands organised into categories: "always run" (e.g., continuous screen recording), "manage command" (system management), "special command", and "shell command".

Destructive commands

• Standalone wiper command — Physical disk-level wipe as described above.
• Windows recovery disable + BSOD — Disables Windows recovery, triggers a blue screen of death, and leaves the device unable to boot.
• Crucio-based ransomware command — Encrypts files with randomly generated keys that are never saved, making decryption impossible. This is functionally a wiper disguised as ransomware.
• AES-256-CBC bulk encrypt/decrypt — A separate command that bulk encrypts or decrypts files using AES-256 in Cipher Block Chaining (CBC) mode. This command retains decryption capability, unlike the Crucio-based command.
• Multi-pass wiping — Referenced by SecurityWeek; additional detail not provided in the source material.

Component lineage

GigaWiper combines components from at least three previously separate malware families:

• Crucio ransomware — Source of the irreversible encryption command.
• Go reimplementation of FlockWiper — Source of the disk-wiping functionality.
• Standalone disk wiper — The standalone PE sample whose code is fully embedded in the backdoor.

Confidence caveats: All technical detail above is sourced from Microsoft Threat Intelligence's blog post and corroborated by Malwarebytes, SecurityWeek, The Hacker News, and The Register. No MITRE ATT&CK actor profile has been resolved for this item; attribution to any named threat actor is unconfirmed. Microsoft has not disclosed victim demographics, sectors, or campaign scale. The C2 IP addresses are single-sourced to Malwarebytes; verify before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

• Hunt for scheduled task OneDrive Update across the estate. Legitimate OneDrive tasks use different names (e.g., OneDrive Sync Engine). Query all endpoints: schtasks /query /tn "OneDrive Update" /fo LIST /v Remove if found: schtasks /delete /tn "OneDrive Update" /f
• Block C2 infrastructure at perimeter firewall and proxy:
• 185.182.193[.]21
• 212.8.248[.]104
• Block AMQP (TCP 5671/5672) and Redis (TCP 6379) egress from endpoint and server VLANs to external addresses unless explicitly required for business services. GigaWiper uses these protocols for C2.
• Deploy EDR detections for the IOCs in §5 and the YARA/Sigma rules in §6. Ensure Malwarebytes detection names Trojan.FlockWiper and Backdoor.GigaWiper are covered if that tool is in use.
• Alert on WMI physical disk enumeration followed by DeviceIoControl calls from unusual processes, particularly Golang-compiled binaries.

P2 — Within 72 hours

• Audit for unstripped Golang PE files on Windows endpoints and servers. GigaWiper samples are unstripped, making them larger than typical Go binaries and identifiable via PE import analysis.
• Restrict MinIO Client (mc) execution on systems where it is not a business requirement. If mc is legitimately used, monitor for uploads to unapproved remote storage endpoints.
• Monitor for Windows event log clearing — alert on Event ID 1102 (Security log cleared) and correlate with other suspicious activity.
• Review backup integrity — confirm offline/immutable backups exist for critical Windows systems. GigaWiper's encryption is irreversible; recovery depends entirely on backup availability.
• Disable unnecessary PowerShell execution via Constrained Language Mode or application whitelisting where feasible, as GigaWiper runs PowerShell commands.

P3 — Within 7 days

• Incorporate wiper scenarios into incident-response tabletop exercises — GigaWiper's combination of espionage followed by irreversible destruction requires rehearsed decision-making around isolation timing.
• Review scheduled-task baselines — establish a known-good inventory of all scheduled tasks across the Windows estate to detect rogue tasks like OneDrive Update.
• Test restoration from offline backups for critical financial-services systems to validate recovery time objectives against a destructive-malware scenario.
• Harden RDP and remote-access paths — since GigaWiper is deployed post-compromise, reducing initial-access surface is the primary preventive control.

5. Indicators of compromise

ipv4  185.182.193[.]21
ipv4  212.8.248[.]104
scheduled_task  OneDrive Update

6. Detection

rule GigaWiper_Backdoor_Wiper {
  meta:
    author = "Adverse Trace"
    date = "2026-07-10"
    reference = "https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/"
    description = "Detects GigaWiper backdoor and standalone wiper components based on distinctive strings and function names"
  strings:
    $func1 = "rabbit_tools_tool_wipe_main.WipeMain" ascii
    $func2 = "main.FindWindowsDrive" ascii
    $func3 = "main.unallocateDrive" ascii
    $func4 = "main.writeRandToDrive" ascii
    $msg1 = "Partitions removed successfully." ascii
    $cmd1 = "OneDrive Update" ascii
    $cmd2 = "always run" ascii
    $cmd3 = "manage command" ascii
    $cmd4 = "special command" ascii
    $cmd5 = "shell command" ascii
    $tool = "Crucio" ascii
  condition:
    3 of them
}

title: GigaWiper Persistence via OneDrive Update Scheduled Task
id: 7a3c1f2e-4b5d-4e8a-9c1f-0a6b2c3d4e5f
status: experimental
description: Detects creation of a scheduled task named "OneDrive Update" used by GigaWiper backdoor for persistence, running every minute and at startup
references:

  - https://www.malwarebytes.com/blog/news/2026/07/this-new-windows-malware-can-take-over-your-pc-and-wipe-it-clean
  - https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/
author: Adverse Trace
date: 2026/07/10
tags:

  - attack.persistence
  - attack.t1053.005
logsource:
  product: windows
  category: process_creation
detection:
  selection_schtasks_create:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains|all:

      - '/create'
      - 'OneDrive Update'
  condition: selection_schtasks_create
fields:

  - CommandLine
  - User
  - ParentImage
falsepositives:

  - Unknown; legitimate OneDrive scheduled tasks use different names (e.g., "OneDrive Sync Engine")
level: high

title: GigaWiper WMI Physical Disk Enumeration via Golang Binary
id: 8b4d2g3f-5c6e-4f9b-ad2g-1b7c3d4e5f6a
status: experimental
description: Detects WMI queries enumerating physical disks, consistent with GigaWiper's main.FindWindowsDrive routine
references:

  - https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/
author: Adverse Trace
date: 2026/07/10
tags:

  - attack.discovery
  - attack.t1047
logsource:
  product: windows
  category: process_creation
detection:
  selection_wmi_disk_enum:
    Image|endswith: '\wmic.exe'
    CommandLine|contains:

      - 'diskdrive'
      - 'PhysicalDisk'
  condition: selection_wmi_disk_enum
fields:

  - CommandLine
  - User
  - ParentImage
falsepositives:

  - Legitimate disk management or inventory tools
level: medium

7. Sources

• Microsoft Threat Intelligence, "GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware," https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/, 2026-07-09
• Malwarebytes Labs, "This new Windows malware can take over your PC and wipe it clean," https://www.malwarebytes.com/blog/news/2026/07/this-new-windows-malware-can-take-over-your-pc-and-wipe-it-clean, 2026-07-10
• SecurityWeek, "GigaWiper Combines Multiple Malware for System-Level Sabotage," https://www.securityweek.com/gigawiper-combines-multiple-malware-for-system-level-sabotage/, 2026-07-10
• The Hacker News, "New GigaWiper Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware," https://thehackernews.com/2026/07/new-gigawiper-windows-backdoor-bundles.html, 2026-07-10
• The Register, "Destructive Windows backdoor stuffs multiple wipers and ransomware code into a single package," https://www.theregister.com/security/2026/07/10/destructive-windows-backdoor-stuffs-multiple-wipers-and-ransomware-code-into-a-single-package/5270053, 2026-07-10

8. Adverse Trace position

GigaWiper represents a high-severity destructive threat to EMEA financial services Windows estates. The malware's combination of espionage capabilities (screen recording, remote control, system inventory, file exfiltration via MinIO) with multiple irreversible destruction methods (physical disk wiping, partition metadata destruction, Crucio-based fake ransomware with unsaved keys, Windows recovery disablement with BSOD) means that by the time destruction is triggered, the attacker has already had sustained access for data collection. No CVE, CVSS score, or CISA-KEV exploitation state applies — this is a post-compromise implant, not a vulnerability exploit. Attribution is unconfirmed; no MITRE actor profile has been resolved. The two C2 IP addresses are single-sourced to Malwarebytes and should be verified before enforcement. We assess that the primary defensive priority for clients is (1) immediate hunting for the OneDrive Update scheduled task and C2 IPs, (2) blocking AMQP/Redis egress, and (3) validating offline backup integrity, as recovery from GigaWiper's destructive commands is impossible without backups. We will update this advisory if Microsoft releases additional IOCs, victim scope data, or attribution.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.