> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware - URL: https://f4n6.co.uk/security-feed/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/ - Published: 2026-07-09T22:22:04.000Z - Updated: 2026-07-09T22:22:04.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary Microsoft Threat Intelligence has detailed GigaWiper, a Golang-based modular backdoor first observed in October 2025 that integrates destructive wiper payloads, fake ransomware, and extensive remote control capabilities. The malware amalgamates code from at least three distinct malware families — including the previously documented Crucio ransomware and FlockWiper — into a single implant, allowing threat actors to conduct espionage and on-demand physical disk wiping. EMEA financial services organisations are at direct risk of catastrophic data loss and operational disruption if compromised, as the fake ransomware payload encrypts files with non-saved keys and the wiper destroys physical disk partitions. Attribution to a specific named threat actor is unconfirmed. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17: ICT-related incident management process | GigaWiper is a destructive backdoor causing disk wiping and system sabotage, requiring incident response capabilities. | Financial entities must ensure their ICT incident management process can detect and respond to destructive wiper and fake ransomware scenarios. | | DORA Art. 18: classification of ICT-related incidents and cyber threats | The malware's physical disk wiping and non-recoverable file encryption constitute severe operational impact. | Incidents involving GigaWiper must be classified as major due to the irreversible destruction of data and systems. | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | A successful GigaWiper deployment causing disk wiping or system sabotage triggers major incident thresholds. | Entities must report GigaWiper intrusions to competent authorities under the prescribed timelines. | | DORA Art. 24: digital operational resilience testing — general requirements | The malware exploits standard Windows management interfaces (WMI, DeviceIoControl) and uses legitimate infrastructure (RabbitMQ, Redis) for C2. | Resilience testing must validate detection of destructive device control operations and anomalous messaging queue traffic. | | NIS2 Art. 21(2)(d): supply chain security measures | GigaWiper incorporates code from multiple malware families (Crucio, FlockWiper), indicating a threat actor reusing and evolving tooling across campaigns. | Essential/important entities should assess their exposure to this evolving toolset and ensure supply chain partners are not compromised. | | NIS2 Art. 23: incident reporting obligations | Destructive wiping and fake ransomware deployment causing significant operational disruption. | NIS2 in-scope organisations must report significant incidents involving this malware to their CSIRTs. | | UK NIS 2018: UK Network and Information Systems Regulations — OES/RDP duties | Destructive backdoor causing irreversible data loss and system boot failure (BSOD). | UK OES and RDSPs must ensure their network and information system security measures account for destructive wiper threats. | ## 3\. Technical analysis & attack chain GigaWiper is an unstripped Golang portable executable (PE) that functions as a modular backdoor. It establishes persistence, communicates via RabbitMQ and Redis, and executes 20 distinct commands, including three separate destructive wiping/encryption payloads derived from older malware families. ### Confirmed attack chain 1. **Initial execution & persistence:** On first execution, the malware checks for the registry key `HKCU\SOFTWARE\OneDrive\Environment`. If absent, it creates the key and sets it to `0`. It then creates a scheduled task named `OneDrive Update` configured to run every minute and once at system startup. The process prints "Task created. Original process exiting." and exits. 2. **Subsequent execution:** On subsequent runs, if the registry key exists and is greater than `0`, the malware increments it, prints "Running from Task Scheduler...", and continues normal execution. 3. **C2 configuration decryption:** The malware decrypts a hard-coded configuration using AES with a hard-coded key. This configuration contains RabbitMQ and Redis server addresses and credentials. 4. **C2 communication:** GigaWiper connects to a RabbitMQ server to receive commands and a Redis server to upload results. It declares a queue and binds it to a fanout exchange named `All` for broadcast commands. Command 8 allows binding to a topic exchange named `Topic` for targeted commands using routing keys. Commands are received as `cmd.Task` structures; results are sent as `cmd.Result` structures. 5. **Operational actions:** The backdoor executes commands (1–20) as instructed by the C2 server, including shell command execution, screenshot capture, screen recording, system info collection, process/service/registry management, event log clearing, and VNC-like remote control. 6. **Destructive execution:** On demand, the threat actor triggers one of three wiping/encryption routines. ### Technical specifics of key components - **Standalone wiper (Command 1 / `WipeMain`):** Enumerates physical disks via WMI. Calls `main.FindWindowsDrive` to identify the Windows installation disk (e.g., `\\.\PHYSICALDRIVE0`). Calls `main.unallocateDrive` on non-Windows drives using `DeviceIoControl` and `IOCTL_DISK_CREATE_DISK` to reinitialize partition metadata. Overwrites drives in `0xA00000`\-byte chunks via `main.writeRandToDrive`; the first byte of each buffer is randomized using `crypto/rand.Read`, the remainder is zero-filled (falls back to byte `1` if random generation fails). Prints "Partitions removed successfully." Forces an immediate system reboot with zero delay. - **Fake ransomware (Command 3 / `RanMain` / `BigBangExtortMain`):** Derived from Crucio ransomware. Generates random AES key and IV that are never saved. Encrypts files in AES-CBC mode, excluding `.exe` and `.dll` files. Deletes originals via `os.Remove` and renames encrypted files with the `.candy` extension. Drops `./image_danger.jpg` and sets it as the desktop wallpaper. No ransom note is dropped; decryption is impossible. - **Multi-pass wiper (Command 12 / `WipeCMain`):** Reimplementation of FlockWiper (originally C-based) in Golang. Similar to Command 1 but targets only the Windows installation drive and performs multiple-pass secure wiping. - **BSOD sabotage (Command 2):** Executes hard-coded destructive commands to disable Windows recovery, take ownership of critical boot and kernel files, grant permissions, and delete them, triggering a Blue Screen of Death and preventing boot. - **Screen recording (Command 10):** Records the screen when the user is not idle (10s threshold) and the system is unlocked. Saves recordings to `C:\ProgramData\output`. - **Event log clearing (Command 19):** Requires Administrator privileges. Deletes System, Setup, Application, and ForwardedEvents logs via `wevtutil.exe`. Prints "kharbvnmhkjbkjb". Attempts to delete Security logs; if `wevtutil.exe` fails, prints "Failed to clear Security with wevtutil. Attempting manual removal..." and directly deletes `C:\Windows\System32\winevt\Logs\Security.evtx`. - **VNC-like remote control (Command 20):** Starts a TCP server on an attacker-specified port. Deletes existing firewall rules and creates new inbound/outbound rules impersonating legitimate Windows firewall rule names to allow traffic to the malware. - **File encryption utility (Command 5):** Bulk encrypts/decrypts files using AES-256-CBC. Accepts key and IV via arguments (`-k`/`-i`) or keyfile (`--keyfile`). If no key/IV is provided in encryption mode, generates random values and stores them in `key.txt`. Error message: "Key/IV required. Use -k/-i or –keyfile". - **Shell execution (Command 7):** Executes PowerShell commands. Appends `;"|?????|$pwd"` to the command to capture the current working directory, then calls `os.Chdir` to maintain directory persistence across commands. ### Attribution and lineage Microsoft links GigaWiper to the same threat actor that developed Crucio ransomware (documented by CISA in December 2023) based on shared code in the `BigBangExtortMain` function. GigaWiper Command 12 is a Golang reimplementation of FlockWiper, sharing identical execution flow and strings. FlockWiper PDB paths reference "GRAT," a name prevalent in GigaWiper function names, suggesting a possible unrecovered framework. Attribution to a specific named threat actor group is unconfirmed; no MITRE ATT&CK actor profile is available in the verified reference data. This assessment is single-sourced from Microsoft Threat Intelligence; verify before enforcement. ## 4\. Mitigation & containment ### P1 — Within 24 hours - Block the following C2 IP addresses at network perimeter and egress firewalls: `185.182.193.21`, `212.8.248.104`. - Hunt for the scheduled task name `OneDrive Update` on all endpoints. Legitimate OneDrive tasks use different naming (e.g., `OneDrive Sync Task`); quarantine any host with this exact task name. - Search for the registry key `HKCU\SOFTWARE\OneDrive\Environment` across the estate. The legitimate OneDrive registry path is `HKCU\SOFTWARE\Microsoft\OneDrive`; this `OneDrive\Environment` subkey is an indicator of GigaWiper persistence. - Block outbound connections on ports `5544` (RabbitMQ C2) and `7542` (Redis C2) if not required for business operations. - Add SHA-256 hashes from §5 to EDR block lists and SIEM threat intelligence feeds. ### P2 — Within 72 hours - Deploy EDR detection rules for the following behaviours: - `DeviceIoControl` calls with `IOCTL_DISK_CREATE_DISK` from non-standard processes. - Processes writing to `\\.\PHYSICALDRIVE*` handles in large chunks. - Creation of files with the `.candy` extension. - Modification of the desktop wallpaper to `image_danger.jpg`. - Direct deletion of `C:\Windows\System32\winevt\Logs\Security.evtx` outside of Event Viewer. - Execution of `wevtutil.exe` clearing multiple log types (System, Setup, Application, ForwardedEvents, Security) in sequence. - Creation of firewall rules with names impersonating legitimate Windows rules by non-system processes. - Monitor for unexpected RabbitMQ fanout exchange named `All` and topic exchange named `Topic` in internal messaging infrastructure. - Audit for the presence of `C:\ProgramData\output` directories containing screen recording artifacts. - Search for `key.txt` files in unexpected directories, which may indicate use of Command 5 (file encryption utility). ### P3 — Within 7 days - Ensure Microsoft Defender Antivirus signatures are current; detections exist for GigaWiper, FlockWiper, and associated components (Giga, Wiper, FlockWiper, CutBrooch, WprFlock, WprCree). - Review scheduled task creation policies; restrict non-administrator task creation where feasible. - Implement application whitelisting to prevent execution of unrecognised Golang binaries from user-writable directories. - Conduct a tabletop exercise simulating a destructive wiper incident to validate backup restoration and ICT incident management procedures (DORA Art. 17). - Validate that offline/immutable backups exist for all critical financial systems and can be restored within RTO/RPO targets. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | ------ | ---------------------------------------------------------------- | ---------- | ----------------------- | | sha256 | 633d4cbd496b1094495da89a64f5e6c31a0f6d4d1488411db5b0cba1cfe42001 | High | Microsoft Security Blog | | sha256 | ce9ad5f6c12019f4aae5b189bd8ddf5bb09e75b06a0a587b25a855c65948c913 | High | Microsoft Security Blog | | sha256 | f622ed85ef31ad4ab973f4e74524866fe1bb44f0965ad2b2ad796cd657a05bfd | High | Microsoft Security Blog | | sha256 | 9706a192e2c1a1faaf0a521daf31c2af60ff4590e3f47bbb4abc227f42af0683 | High | Microsoft Security Blog | | sha256 | 3c30deb6556a94cfb84ae51798f4aecfae8c7358e55fdb321c5f2376579631cd | High | Microsoft Security Blog | | sha256 | 440b5385d3838e3f6bc21220caa83b65cd5f3618daea676f271c3671650ce9a3 | High | Microsoft Security Blog | | sha256 | 12c39f052f030a77c0cd531df86ad3477f46d1287b8b98b625d1dcf89385d721 | High | Microsoft Security Blog | | sha256 | db41e0da7ab3305be8d9720769c6950b4dc1c1984ef857d3310eb873a0fc7674 | High | Microsoft Security Blog | | ipv4 | 185.182.193.21 | High | Microsoft Security Blog | | ipv4 | 212.8.248.104 | High | Microsoft Security Blog | ```iocs sha256 633d4cbd496b1094495da89a64f5e6c31a0f6d4d1488411db5b0cba1cfe42001 sha256 ce9ad5f6c12019f4aae5b189bd8ddf5bb09e75b06a0a587b25a855c65948c913 sha256 f622ed85ef31ad4ab973f4e74524866fe1bb44f0965ad2b2ad796cd657a05bfd sha256 9706a192e2c1a1faaf0a521daf31c2af60ff4590e3f47bbb4abc227f42af0683 sha256 3c30deb6556a94cfb84ae51798f4aecfae8c7358e55fdb321c5f2376579631cd sha256 440b5385d3838e3f6bc21220caa83b65cd5f3618daea676f271c3671650ce9a3 sha256 12c39f052f030a77c0cd531df86ad3477f46d1287b8b98b625d1dcf89385d721 sha256 db41e0da7ab3305be8d9720769c6950b4dc1c1984ef857d3310eb873a0fc7674 ipv4 185.182.193.21 ipv4 212.8.248.104 ``` ## 6\. Detection ```yara rule GigaWiper_Backdoor { meta: author = "Adverse Trace" date = "2026-07-09" reference = "https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/" description = "Detects GigaWiper backdoor and associated wiper components based on strings and function names" strings: $s1 = "Partitions removed successfully." ascii $s2 = "Task created. Original process exiting." ascii $s3 = "Running from Task Scheduler..." ascii $s4 = "OneDrive Update" ascii $s5 = "OneDrive\\Environment" ascii $s6 = "rabbit_tools_tool_wipe_main.WipeMain" ascii $s7 = "rabbit_tools_tool_ran_main_cmd_extort.RanMain" ascii $s8 = "rabbit_tools_tool_ran_main_bin.BigBangExtortMain" ascii $s9 = "rabbit_tools_tool_wipec_main.WipeCMain" ascii $s10 = "rabbit_bin.RunOnceRegistryMain.gowrap1" ascii $s11 = "image_danger.jpg" ascii $s12 = ".candy" ascii $s13 = "kharbvnmhkjbkjb" ascii $s14 = "Failed to clear Security with wevtutil. Attempting manual removal..." ascii $s15 = "Key/IV required. Use -k/-i or –keyfile" ascii $s16 = "Exec cmd wipe-file" ascii $s17 = "Exec cmd keylog" ascii $s18 = "Exec cmd wipe32" ascii $s19 = "C:\\ProgramData\\output" ascii $s20 = "C:\\Windows\\System32\\winevt\\Logs\\Security.evtx" ascii $s21 = "GRATClientInfo" ascii $s22 = "All" ascii $s23 = "Topic" ascii $s24 = "key.txt" ascii condition: uint16(0) == 0x5A4D and 6 of them } ``` ```yaml title: Detect GigaWiper Backdoor Persistence and Destructive Activity id: 7a3c1f2e-4b5d-4e8a-9c1f-2d3e4f5a6b7c status: experimental description: Detects GigaWiper scheduled task creation, registry persistence, event log clearing, and wallpaper modification behaviours author: Adverse Trace date: 2026/07/09 references: - https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/ logsource: product: windows category: process_creation detection: selection_schtasks: Image|endswith: '\schtasks.exe' CommandLine|contains|all: - '/create' - 'OneDrive Update' selection_regkey: EventType: 'Registry value set' TargetObject|contains: 'HKCU\SOFTWARE\OneDrive\Environment' selection_wevtutil: Image|endswith: '\wevtutil.exe' CommandLine|contains|all: - 'cl' - 'System' selection_wevtutil_security: Image|endswith: '\wevtutil.exe' CommandLine|contains|all: - 'cl' - 'Security' selection_security_evtx_delete: Image|endswith: '\cmd.exe' CommandLine|contains: 'C:\Windows\System32\winevt\Logs\Security.evtx' selection_wallpaper: CommandLine|contains: 'image_danger.jpg' selection_powershell_marker: CommandLine|contains: '|?????|$pwd' condition: selection_schtasks or selection_regkey or selection_wevtutil or selection_wevtutil_security or selection_security_evtx_delete or selection_wallpaper or selection_powershell_marker falsepositives: - Legitimate administrative use of wevtutil for log clearing (verify context) - Custom scripts using the |?????| string pattern (unlikely) level: high ``` ## 7\. Sources - Microsoft Security Blog, "GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware," https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/, 2026-07-09 ## 8\. Adverse Trace position GigaWiper represents a high-severity destructive threat to EMEA financial services organisations. The malware's modular architecture — combining three distinct wiper/encryption families with robust backdoor capabilities including VNC-like remote control, screen recording, and keylogging — provides threat actors with both espionage and irreversible destruction options. The fake ransomware payload (Command 3) is particularly dangerous: it encrypts files with non-saved keys and drops no ransom note, meaning affected organisations face total data loss with no recovery path. The use of RabbitMQ and Redis for C2, along with legitimate-sounding scheduled task names (`OneDrive Update`) and firewall rule impersonation, makes this malware difficult to detect without behavioural EDR coverage. Attribution to a specific threat actor group is unconfirmed; the link to Crucio and FlockWiper is based on code analysis from a single source (Microsoft Threat Intelligence) and should be verified before enforcement actions. Adverse Trace will continue monitoring for additional IOCs, attribution updates, and any emergence of the unrecovered "GRAT" framework referenced in FlockWiper PDB paths. Clients should prioritise P1 network blocking and endpoint hunting immediately. --- [Read the original source →](https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*