> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # GigaWiper Lets Threat Actors Choose Their Own Destructive Attack - URL: https://f4n6.co.uk/security-feed/gigawiper-lets-threat-actors-choose-their-own-destructive-attack/ - Published: 2026-07-13T22:16:10.000Z - Updated: 2026-07-13T22:16:10.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary Microsoft Threat Intelligence has disclosed GigaWiper, a modular Golang-based Windows backdoor observed in destructive intrusions since October 2025\. The implant consolidates capabilities from multiple previously separate malware families — including the Crucio ransomware and the FlockWiper disk wiper — into a single framework offering approximately 20 commands spanning physical disk wiping, fake ransomware encryption, remote access, and system sabotage. The malware establishes persistence via a scheduled task and maintains C2 communication with hardcoded servers. No verified CVE data, CVSS scores, or CISA-KEV exploitation states have been resolved for this item, and no threat actor attribution has been confirmed by MITRE. EMEA financial services organisations should treat this as a high-impact destructive threat capable of irreversible data loss on compromised Windows endpoints. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | DORA Art. 17: ICT-related incident management process | GigaWiper causes irreversible disk-level wiping and system sabotage, constituting a major ICT-related incident if deployed within a financial entity's environment. | Organisations must have processes to detect, contain, and respond to destructive wiping events as part of their ICT-related incident management. | | DORA Art. 18: classification of ICT-related incidents and cyber threats | GigaWiper represents a cyber threat with destructive impact classification criteria (data destruction, operational disruption). | Incidents involving GigaWiper must be classified according to the entity's ICT incident classification methodology, factoring in data loss and operational impact. | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | A successful GigaWiper deployment causing irreversible data destruction and system outage would meet major incident thresholds. | Financial entities must be prepared to report GigaWiper-related incidents to competent authorities within applicable timelines. | | DORA Art. 24: digital operational resilience testing — general requirements | GigaWiper's use of scheduled tasks, WMI queries, and DeviceIoControl calls represents techniques that should be covered by resilience testing. | Organisations should validate that their detection and response capabilities cover destructive malware techniques through their resilience testing programmes. | | NIS2 Art. 21(2)(d): supply chain security measures | GigaWiper is deployed after attackers have already compromised a system, meaning initial access vectors (potentially supply-chain-related) are a prerequisite. | In-scope organisations should ensure supply chain security measures address initial access prevention that precedes destructive payload deployment. | | NIS2 Art. 23: incident reporting obligations | A GigaWiper deployment causing significant operational disruption triggers incident reporting duties for NIS2 in-scope entities. | Organisations must report GigaWiper incidents per NIS2 timelines, including early warning and incident notification requirements. | | UK NIS 2018: UK Network and Information Systems Regulations — OES/RDSP duties | Destructive wiping of systems causing operational disruption engages OES/RDSP incident management and reporting obligations. | UK OES and RDSPs must manage and report GigaWiper-related incidents per their regulatory duties. | ## 3\. Technical analysis & attack chain ### Overview GigaWiper is a Golang-compiled, unstripped portable executable (PE) for Windows. Microsoft identified two sample types: a standalone wiper and a larger backdoor. The standalone wiper's code is fully embedded inside the backdoor as one of its commands, implemented as `rabbit_tools_tool_wipe_main.WipeMain`. The malware amalgamates functionality from at least two previously separate malware families: the Crucio ransomware and the FlockWiper disk wiper. Attribution to a specific threat actor is unconfirmed — no MITRE threat actor profile has been resolved for this item. ### Attack chain (confirmed steps) 1. **Initial access** — GigaWiper is deployed after attackers have already compromised a system. The initial access vector is not specified in the source material. This is a critical gap: GigaWiper is a post-compromise tool, not an initial-access loader. 2. **Persistence** — The malware creates a Windows scheduled task named `OneDrive Update` that runs every minute and at system startup to maintain persistence. 3. **System reconnaissance** — The backdoor collects comprehensive system information including hardware, operating system, network configuration, firmware details, user accounts, and installed antivirus products. 4. **Command-and-control** — GigaWiper communicates with hardcoded C2 servers at `185.182.193[.]21` and `212.8.248[.]104`. The backdoor implements approximately 20 commands across three categories: destruction, remote access/monitoring, and system management. 5. **Remote access and monitoring** — Capabilities include screen capture, VNC-like remote control, and system inventory collection. Process, service, and registry management utilities allow the operator to create, list, or kill processes; manage Windows services; and navigate and mutate registry keys. 6. **Destructive payload execution** — The operator selects from multiple destructive modes: - **Standalone wiper / disk wiping** — Wipes at the physical disk level rather than deleting individual files. - **Fake ransomware** — Ransomware encryption functionality (sourced from Crucio ransomware) is present, though the source characterises this as "fake ransomware," suggesting the intent is destruction rather than genuine extortion. - **Multi-pass wiping** — A multi-pass wiping command is available. ### Wiper mechanism (technical detail) The wiper component operates at the physical disk level with the following confirmed code flow: 1. **Disk enumeration** — Enumerates physical disks via WMI, retrieving device identifiers and disk metadata. 2. **Windows drive identification** — Calls `main.FindWindowsDrive` to determine which physical disk contains the Windows installation (e.g., `\\.\PHYSICALDRIVE0`). 3. **Partition destruction** — Iterates remaining (non-Windows) disks and calls `main.unallocateDrive` on each. This uses `DeviceIoControl` with `IOCTL_DISK_CREATE_DISK` to reinitialise the disk's partitioning metadata, effectively wiping existing partition table entries. On success, the malware prints `"Partitions removed successfully."` to the console. 4. **Raw disk overwrite** — Calls `main.writeRandToDrive` to overwrite each drive in chunks of `0xA00000` bytes (approximately 10 MB). The first byte of each buffer is randomised using `crypto/rand.Read`; the remaining bytes are zero-filled. If random generation fails, the byte value `0x01` is used instead. This pattern is assessed as a detection-evasion measure against signatures looking for full-disk zeroing. 5. **Forced reboot** — Invokes Windows shutdown functionality with restart and zero-delay options, forcing an immediate system reboot after wiping completes. ### Command structure The backdoor's \~20 commands fall into three categories: - **Destruction**: standalone wiper, ransomware encryption, multi-pass wiping. - **Remote access/monitoring**: screen capture, VNC-like remote control, system inventory. - **System management**: process management (create/list/kill), service management, registry navigation and mutation, system information collection (hardware, OS, network, firmware, user, antivirus). ### Detection names Malwarebytes detects GigaWiper components as `Trojan.FlockWiper` and `Backdoor.GigaWiper`. **Confidence caveat**: The attribution of GigaWiper's components to the Crucio ransomware and FlockWiper families is sourced from Malwarebytes Labs (single-sourced for that specific claim; Microsoft's blog does not name these families in the provided excerpts). The C2 IP addresses are sourced from Malwarebytes Labs. Verify before enforcement. ## 4\. Mitigation & containment ### P1 — Within 24 hours - **Block C2 infrastructure** at network perimeter and egress filters: - `185.182.193.21` - `212.8.248.104` - **Hunt for persistence mechanism** — Search all Windows endpoints for scheduled tasks named `OneDrive Update`: `powershell Get-ScheduledTask -TaskName "OneDrive Update" | Format-List *` Legitimate OneDrive tasks use names like `OneDrive* - TaskSync` and similar; a task named exactly `OneDrive Update` running every minute is anomalous. - **EDR / AV signature update** — Ensure detection engines are current. If using Malwarebytes, confirm detection names `Trojan.FlockWiper` and `Backdoor.GigaWiper` are active. - **Isolate any compromised hosts** — If GigaWiper is identified on a system, isolate immediately. If the wiper has executed, assume irreversible data loss on affected physical disks. ### P2 — Within 72 hours - **Deploy behavioural detection rules** — See §6 for YARA and Sigma rules targeting GigaWiper artefacts and behaviours. - **Audit scheduled tasks enterprise-wide** — Enumerate all scheduled tasks across the estate and flag any with one-minute repetition intervals, particularly those masquerading as legitimate software update tasks. - **Monitor for WMI disk enumeration** — Alert on processes issuing WMI queries that enumerate physical disks, especially from unexpected or unsigned Golang-compiled binaries. - **Monitor for DeviceIoControl + IOCTL\_DISK\_CREATE\_DISK** — Alert on any process issuing this control code to physical drive handles, which is highly anomalous outside disk management tooling. - **Review initial access vectors** — Since GigaWiper is deployed post-compromise, investigate how the attacker gained initial access. Treat any GigaWiper finding as evidence of a broader intrusion. ### P3 — Within 7 days - **Backup verification** — Verify that offline/immutable backups are current and test restoration procedures. GigaWiper's physical disk wiping is irreversible; backups are the only recovery path. - **Endpoint hardening** — Restrict access to raw disk devices (`\\.\PHYSICALDRIVE*`) using application control / WDAC policies. Legitimate administrative tools can be allowlisted; all other processes should be denied direct disk access. - **Threat hunt for Golang binaries** — Search for unstripped Golang-compiled PE files on endpoints, particularly those exhibiting network communication to non-corporate IPs. GigaWiper samples are unstripped, which is unusual for production malware and may aid identification. - **Incident response playbook update** — Incorporate GigaWiper-specific indicators and behaviours into destructive-ware IR playbooks. Emphasise that "ransomware" activity may be destructive-only (fake ransomware) with no decryption path. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | --------------- | ------------------ | -------------------------------- | ---------------------------- | | ipv4 | 185.182.193\[.\]21 | Medium — single-sourced | Malwarebytes Labs | | ipv4 | 212.8.248\[.\]104 | Medium — single-sourced | Malwarebytes Labs | | scheduled\_task | OneDrive Update | High — multi-source corroborated | Malwarebytes Labs; Microsoft | | mutex | (none available) | — | — | | file\_hash | (none available) | — | — | ```iocs ipv4 185.182.193.21 ipv4 212.8.248.104 scheduled_task OneDrive Update ``` Note: IP addresses are defanged in the table per source convention; the plaintext block contains undefanged values for tooling ingestion. These are single-sourced from Malwarebytes Labs — verify before enforcement. ## 6\. Detection ```yara rule GigaWiper_Backdoor_Wiper { meta: author = "Adverse Trace" date = "2026-07-13" reference = "https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/" description = "Detects GigaWiper backdoor and wiper components by function names and embedded strings" strings: $func1 = "rabbit_tools_tool_wipe_main.WipeMain" ascii $func2 = "main.FindWindowsDrive" ascii $func3 = "main.unallocateDrive" ascii $func4 = "main.writeRandToDrive" ascii $str1 = "Partitions removed successfully." ascii $str2 = "OneDrive Update" ascii $ioctl = "IOCTL_DISK_CREATE_DISK" ascii condition: 3 of them } ``` ```yaml title: GigaWiper Persistence via OneDrive Update Scheduled Task id: 7a3c1f2e-4b5d-4a8e-9c1f-2d3e4f5a6b7c status: experimental description: Detects creation of a scheduled task named "OneDrive Update" consistent with GigaWiper backdoor persistence references: - https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/ - https://www.malwarebytes.com/blog/news/2026/07/this-new-windows-malware-can-take-over-your-pc-and-wipe-it-clean author: Adverse Trace date: 2026/07/13 tags: - attack.persistence - attack.t1053.005 - attack.scheduled_task logsource: product: windows category: scheduled_task_creation detection: selection: TaskName|contains: "OneDrive Update" condition: selection falsepositives: - Legitimate OneDrive update tasks (verify repetition interval — GigaWiper runs every minute) level: high ``` ```yaml title: GigaWiper Wiper Disk Overwrite via DeviceIoControl id: 8b4d2g3f-5c6e-4b9f-0d2g-3e4f5a6b7c8d status: experimental description: Detects processes issuing IOCTL_DISK_CREATE_DISK to physical drive handles, consistent with GigaWiper wiper component references: - https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/ author: Adverse Trace date: 2026/07/13 tags: - attack.impact - attack.t1561.002 logsource: product: windows category: driver_load detection: selection_event: EventID: 6 filter_legitimate: Image|startswith: - "C:\\Windows\\System32\\" - "C:\\Program Files\\" condition: selection_event and not filter_legitimate falsepositives: - Legitimate disk management tools (diskpart, format, partition managers) level: high ``` ## 7\. Sources - DarkReading — "GigaWiper Lets Threat Actors Choose Their Own Destructive Attack" — https://www.darkreading.com/cyberattacks-data-breaches/gigawiper-threat-actors-choose-their-own-destructive-attack — 2026-07-13 - SecurityWeek — "GigaWiper Combines Multiple Malware for System-Level Sabotage" — https://www.securityweek.com/gigawiper-combines-multiple-malware-for-system-level-sabotage/ — 2026-07 (exact date not specified) - Microsoft Threat Intelligence — "GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware" — https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/ — 2026-07-09 - Malwarebytes Labs — "This new Windows malware can take over your PC and wipe it clean" — https://www.malwarebytes.com/blog/news/2026/07/this-new-windows-malware-can-take-over-your-pc-and-wipe-it-clean — 2026-07 ## 8\. Adverse Trace position GigaWiper represents a significant evolution in destructive malware: a modular Golang backdoor that gives operators on-demand choice between espionage, fake ransomware, and irreversible physical disk wiping within a single implant. The technical sophistication — WMI-based disk enumeration, `IOCTL_DISK_CREATE_DISK` partition destruction, randomised overwrite patterns for detection evasion, and forced reboot — indicates a capable developer with knowledge of Windows storage internals. The absence of confirmed CVE data, CISA-KEV exploitation status, or MITRE-attributed threat actor means we cannot currently link GigaWiper to a known campaign or initial-access vector; the C2 IP addresses and malware family attributions (Crucio, FlockWiper) are single-sourced from Malwarebytes Labs and should be verified before enforcement. For EMEA financial services clients, the primary risk is post-compromise deployment: GigaWiper is not an initial-access tool but a finisher. The defence priority is detecting the `OneDrive Update` scheduled task, blocking the two known C2 IPs, and ensuring offline backups are current — because once the wiper executes, recovery from affected disks is not possible. Adverse Trace will monitor for additional IOCs, attribution updates, and any confirmed initial-access vectors, and will issue a revised advisory if verified data becomes available. --- [Read the original source →](https://www.darkreading.com/cyberattacks-data-breaches/gigawiper-threat-actors-choose-their-own-destructive-attack?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*