GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

1. Executive summary

Microsoft Threat Intelligence has detailed GigaWiper, a Golang-based modular backdoor first observed in October 2025 that integrates destructive wiper payloads, fake ransomware, and extensive remote control capabilities. The malware amalgamates code from at least three distinct malware families — including the previously documented Crucio ransomware and FlockWiper — into a single implant, allowing threat actors to conduct espionage and on-demand physical disk wiping. EMEA financial services organisations are at direct risk of catastrophic data loss and operational disruption if compromised, as the fake ransomware payload encrypts files with non-saved keys and the wiper destroys physical disk partitions. Attribution to a specific named threat actor is unconfirmed.

2. Regulatory framing

3. Technical analysis & attack chain

GigaWiper is an unstripped Golang portable executable (PE) that functions as a modular backdoor. It establishes persistence, communicates via RabbitMQ and Redis, and executes 20 distinct commands, including three separate destructive wiping/encryption payloads derived from older malware families.

Confirmed attack chain

1. Initial execution & persistence: On first execution, the malware checks for the registry key HKCU\SOFTWARE\OneDrive\Environment. If absent, it creates the key and sets it to 0. It then creates a scheduled task named OneDrive Update configured to run every minute and once at system startup. The process prints "Task created. Original process exiting." and exits.
2. Subsequent execution: On subsequent runs, if the registry key exists and is greater than 0, the malware increments it, prints "Running from Task Scheduler...", and continues normal execution.
3. C2 configuration decryption: The malware decrypts a hard-coded configuration using AES with a hard-coded key. This configuration contains RabbitMQ and Redis server addresses and credentials.
4. C2 communication: GigaWiper connects to a RabbitMQ server to receive commands and a Redis server to upload results. It declares a queue and binds it to a fanout exchange named All for broadcast commands. Command 8 allows binding to a topic exchange named Topic for targeted commands using routing keys. Commands are received as cmd.Task structures; results are sent as cmd.Result structures.
5. Operational actions: The backdoor executes commands (1–20) as instructed by the C2 server, including shell command execution, screenshot capture, screen recording, system info collection, process/service/registry management, event log clearing, and VNC-like remote control.
6. Destructive execution: On demand, the threat actor triggers one of three wiping/encryption routines.

Technical specifics of key components

• Standalone wiper (Command 1 / WipeMain): Enumerates physical disks via WMI. Calls main.FindWindowsDrive to identify the Windows installation disk (e.g., \\.\PHYSICALDRIVE0). Calls main.unallocateDrive on non-Windows drives using DeviceIoControl and IOCTL_DISK_CREATE_DISK to reinitialize partition metadata. Overwrites drives in 0xA00000-byte chunks via main.writeRandToDrive; the first byte of each buffer is randomized using crypto/rand.Read, the remainder is zero-filled (falls back to byte 1 if random generation fails). Prints "Partitions removed successfully." Forces an immediate system reboot with zero delay.
• Fake ransomware (Command 3 / RanMain / BigBangExtortMain): Derived from Crucio ransomware. Generates random AES key and IV that are never saved. Encrypts files in AES-CBC mode, excluding .exe and .dll files. Deletes originals via os.Remove and renames encrypted files with the .candy extension. Drops ./image_danger.jpg and sets it as the desktop wallpaper. No ransom note is dropped; decryption is impossible.
• Multi-pass wiper (Command 12 / WipeCMain): Reimplementation of FlockWiper (originally C-based) in Golang. Similar to Command 1 but targets only the Windows installation drive and performs multiple-pass secure wiping.
• BSOD sabotage (Command 2): Executes hard-coded destructive commands to disable Windows recovery, take ownership of critical boot and kernel files, grant permissions, and delete them, triggering a Blue Screen of Death and preventing boot.
• Screen recording (Command 10): Records the screen when the user is not idle (10s threshold) and the system is unlocked. Saves recordings to C:\ProgramData\output.
• Event log clearing (Command 19): Requires Administrator privileges. Deletes System, Setup, Application, and ForwardedEvents logs via wevtutil.exe. Prints "kharbvnmhkjbkjb". Attempts to delete Security logs; if wevtutil.exe fails, prints "Failed to clear Security with wevtutil. Attempting manual removal..." and directly deletes C:\Windows\System32\winevt\Logs\Security.evtx.
• VNC-like remote control (Command 20): Starts a TCP server on an attacker-specified port. Deletes existing firewall rules and creates new inbound/outbound rules impersonating legitimate Windows firewall rule names to allow traffic to the malware.
• File encryption utility (Command 5): Bulk encrypts/decrypts files using AES-256-CBC. Accepts key and IV via arguments (-k/-i) or keyfile (--keyfile). If no key/IV is provided in encryption mode, generates random values and stores them in key.txt. Error message: "Key/IV required. Use -k/-i or –keyfile".
• Shell execution (Command 7): Executes PowerShell commands. Appends ;"|?????|$pwd" to the command to capture the current working directory, then calls os.Chdir to maintain directory persistence across commands.

Attribution and lineage

Microsoft links GigaWiper to the same threat actor that developed Crucio ransomware (documented by CISA in December 2023) based on shared code in the BigBangExtortMain function. GigaWiper Command 12 is a Golang reimplementation of FlockWiper, sharing identical execution flow and strings. FlockWiper PDB paths reference "GRAT," a name prevalent in GigaWiper function names, suggesting a possible unrecovered framework. Attribution to a specific named threat actor group is unconfirmed; no MITRE ATT&CK actor profile is available in the verified reference data. This assessment is single-sourced from Microsoft Threat Intelligence; verify before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

• Block the following C2 IP addresses at network perimeter and egress firewalls: 185.182.193.21, 212.8.248.104.
• Hunt for the scheduled task name OneDrive Update on all endpoints. Legitimate OneDrive tasks use different naming (e.g., OneDrive Sync Task); quarantine any host with this exact task name.
• Search for the registry key HKCU\SOFTWARE\OneDrive\Environment across the estate. The legitimate OneDrive registry path is HKCU\SOFTWARE\Microsoft\OneDrive; this OneDrive\Environment subkey is an indicator of GigaWiper persistence.
• Block outbound connections on ports 5544 (RabbitMQ C2) and 7542 (Redis C2) if not required for business operations.
• Add SHA-256 hashes from §5 to EDR block lists and SIEM threat intelligence feeds.

P2 — Within 72 hours

• Deploy EDR detection rules for the following behaviours:
• DeviceIoControl calls with IOCTL_DISK_CREATE_DISK from non-standard processes.
• Processes writing to \\.\PHYSICALDRIVE* handles in large chunks.
• Creation of files with the .candy extension.
• Modification of the desktop wallpaper to image_danger.jpg.
• Direct deletion of C:\Windows\System32\winevt\Logs\Security.evtx outside of Event Viewer.
• Execution of wevtutil.exe clearing multiple log types (System, Setup, Application, ForwardedEvents, Security) in sequence.
• Creation of firewall rules with names impersonating legitimate Windows rules by non-system processes.
• Monitor for unexpected RabbitMQ fanout exchange named All and topic exchange named Topic in internal messaging infrastructure.
• Audit for the presence of C:\ProgramData\output directories containing screen recording artifacts.
• Search for key.txt files in unexpected directories, which may indicate use of Command 5 (file encryption utility).

P3 — Within 7 days

• Ensure Microsoft Defender Antivirus signatures are current; detections exist for GigaWiper, FlockWiper, and associated components (Giga, Wiper, FlockWiper, CutBrooch, WprFlock, WprCree).
• Review scheduled task creation policies; restrict non-administrator task creation where feasible.
• Implement application whitelisting to prevent execution of unrecognised Golang binaries from user-writable directories.
• Conduct a tabletop exercise simulating a destructive wiper incident to validate backup restoration and ICT incident management procedures (DORA Art. 17).
• Validate that offline/immutable backups exist for all critical financial systems and can be restored within RTO/RPO targets.

5. Indicators of compromise

sha256  633d4cbd496b1094495da89a64f5e6c31a0f6d4d1488411db5b0cba1cfe42001
sha256  ce9ad5f6c12019f4aae5b189bd8ddf5bb09e75b06a0a587b25a855c65948c913
sha256  f622ed85ef31ad4ab973f4e74524866fe1bb44f0965ad2b2ad796cd657a05bfd
sha256  9706a192e2c1a1faaf0a521daf31c2af60ff4590e3f47bbb4abc227f42af0683
sha256  3c30deb6556a94cfb84ae51798f4aecfae8c7358e55fdb321c5f2376579631cd
sha256  440b5385d3838e3f6bc21220caa83b65cd5f3618daea676f271c3671650ce9a3
sha256  12c39f052f030a77c0cd531df86ad3477f46d1287b8b98b625d1dcf89385d721
sha256  db41e0da7ab3305be8d9720769c6950b4dc1c1984ef857d3310eb873a0fc7674
ipv4  185.182.193.21
ipv4  212.8.248.104

6. Detection

rule GigaWiper_Backdoor {
  meta:
    author = "Adverse Trace"
    date = "2026-07-09"
    reference = "https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/"
    description = "Detects GigaWiper backdoor and associated wiper components based on strings and function names"

  strings:
    $s1 = "Partitions removed successfully." ascii
    $s2 = "Task created. Original process exiting." ascii
    $s3 = "Running from Task Scheduler..." ascii
    $s4 = "OneDrive Update" ascii
    $s5 = "OneDrive\\Environment" ascii
    $s6 = "rabbit_tools_tool_wipe_main.WipeMain" ascii
    $s7 = "rabbit_tools_tool_ran_main_cmd_extort.RanMain" ascii
    $s8 = "rabbit_tools_tool_ran_main_bin.BigBangExtortMain" ascii
    $s9 = "rabbit_tools_tool_wipec_main.WipeCMain" ascii
    $s10 = "rabbit_bin.RunOnceRegistryMain.gowrap1" ascii
    $s11 = "image_danger.jpg" ascii
    $s12 = ".candy" ascii
    $s13 = "kharbvnmhkjbkjb" ascii
    $s14 = "Failed to clear Security with wevtutil. Attempting manual removal..." ascii
    $s15 = "Key/IV required. Use -k/-i or –keyfile" ascii
    $s16 = "Exec cmd wipe-file" ascii
    $s17 = "Exec cmd keylog" ascii
    $s18 = "Exec cmd wipe32" ascii
    $s19 = "C:\\ProgramData\\output" ascii
    $s20 = "C:\\Windows\\System32\\winevt\\Logs\\Security.evtx" ascii
    $s21 = "GRATClientInfo" ascii
    $s22 = "All" ascii
    $s23 = "Topic" ascii
    $s24 = "key.txt" ascii

  condition:
    uint16(0) == 0x5A4D and 6 of them
}

title: Detect GigaWiper Backdoor Persistence and Destructive Activity
id: 7a3c1f2e-4b5d-4e8a-9c1f-2d3e4f5a6b7c
status: experimental
description: Detects GigaWiper scheduled task creation, registry persistence, event log clearing, and wallpaper modification behaviours
author: Adverse Trace
date: 2026/07/09
references:

  - https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/
logsource:
  product: windows
  category: process_creation
detection:
  selection_schtasks:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains|all:

      - '/create'
      - 'OneDrive Update'
  selection_regkey:
    EventType: 'Registry value set'
    TargetObject|contains: 'HKCU\SOFTWARE\OneDrive\Environment'
  selection_wevtutil:
    Image|endswith: '\wevtutil.exe'
    CommandLine|contains|all:

      - 'cl'
      - 'System'
  selection_wevtutil_security:
    Image|endswith: '\wevtutil.exe'
    CommandLine|contains|all:

      - 'cl'
      - 'Security'
  selection_security_evtx_delete:
    Image|endswith: '\cmd.exe'
    CommandLine|contains: 'C:\Windows\System32\winevt\Logs\Security.evtx'
  selection_wallpaper:
    CommandLine|contains: 'image_danger.jpg'
  selection_powershell_marker:
    CommandLine|contains: '|?????|$pwd'
  condition: selection_schtasks or selection_regkey or selection_wevtutil or selection_wevtutil_security or selection_security_evtx_delete or selection_wallpaper or selection_powershell_marker
falsepositives:

  - Legitimate administrative use of wevtutil for log clearing (verify context)
  - Custom scripts using the |?????| string pattern (unlikely)
level: high

7. Sources

• Microsoft Security Blog, "GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware," https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/, 2026-07-09

8. Adverse Trace position

GigaWiper represents a high-severity destructive threat to EMEA financial services organisations. The malware's modular architecture — combining three distinct wiper/encryption families with robust backdoor capabilities including VNC-like remote control, screen recording, and keylogging — provides threat actors with both espionage and irreversible destruction options. The fake ransomware payload (Command 3) is particularly dangerous: it encrypts files with non-saved keys and drops no ransom note, meaning affected organisations face total data loss with no recovery path. The use of RabbitMQ and Redis for C2, along with legitimate-sounding scheduled task names (OneDrive Update) and firewall rule impersonation, makes this malware difficult to detect without behavioural EDR coverage. Attribution to a specific threat actor group is unconfirmed; the link to Crucio and FlockWiper is based on code analysis from a single source (Microsoft Threat Intelligence) and should be verified before enforcement actions. Adverse Trace will continue monitoring for additional IOCs, attribution updates, and any emergence of the unrecovered "GRAT" framework referenced in FlockWiper PDB paths. Clients should prioritise P1 network blocking and endpoint hunting immediately.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.