GigaWiper Lets Threat Actors Choose Their Own Destructive Attack

1. Executive summary

Microsoft Threat Intelligence has disclosed GigaWiper, a modular Golang-based Windows backdoor observed in destructive intrusions since October 2025. The implant consolidates capabilities from multiple previously separate malware families — including the Crucio ransomware and the FlockWiper disk wiper — into a single framework offering approximately 20 commands spanning physical disk wiping, fake ransomware encryption, remote access, and system sabotage. The malware establishes persistence via a scheduled task and maintains C2 communication with hardcoded servers. No verified CVE data, CVSS scores, or CISA-KEV exploitation states have been resolved for this item, and no threat actor attribution has been confirmed by MITRE. EMEA financial services organisations should treat this as a high-impact destructive threat capable of irreversible data loss on compromised Windows endpoints.

2. Regulatory framing

3. Technical analysis & attack chain

Overview

GigaWiper is a Golang-compiled, unstripped portable executable (PE) for Windows. Microsoft identified two sample types: a standalone wiper and a larger backdoor. The standalone wiper's code is fully embedded inside the backdoor as one of its commands, implemented as rabbit_tools_tool_wipe_main.WipeMain. The malware amalgamates functionality from at least two previously separate malware families: the Crucio ransomware and the FlockWiper disk wiper. Attribution to a specific threat actor is unconfirmed — no MITRE threat actor profile has been resolved for this item.

Attack chain (confirmed steps)

1. Initial access — GigaWiper is deployed after attackers have already compromised a system. The initial access vector is not specified in the source material. This is a critical gap: GigaWiper is a post-compromise tool, not an initial-access loader.
2. Persistence — The malware creates a Windows scheduled task named OneDrive Update that runs every minute and at system startup to maintain persistence.
3. System reconnaissance — The backdoor collects comprehensive system information including hardware, operating system, network configuration, firmware details, user accounts, and installed antivirus products.
4. Command-and-control — GigaWiper communicates with hardcoded C2 servers at 185.182.193[.]21 and 212.8.248[.]104. The backdoor implements approximately 20 commands across three categories: destruction, remote access/monitoring, and system management.
5. Remote access and monitoring — Capabilities include screen capture, VNC-like remote control, and system inventory collection. Process, service, and registry management utilities allow the operator to create, list, or kill processes; manage Windows services; and navigate and mutate registry keys.
6. Destructive payload execution — The operator selects from multiple destructive modes: - Standalone wiper / disk wiping — Wipes at the physical disk level rather than deleting individual files. - Fake ransomware — Ransomware encryption functionality (sourced from Crucio ransomware) is present, though the source characterises this as "fake ransomware," suggesting the intent is destruction rather than genuine extortion. - Multi-pass wiping — A multi-pass wiping command is available.

Wiper mechanism (technical detail)

The wiper component operates at the physical disk level with the following confirmed code flow:

1. Disk enumeration — Enumerates physical disks via WMI, retrieving device identifiers and disk metadata.
2. Windows drive identification — Calls main.FindWindowsDrive to determine which physical disk contains the Windows installation (e.g., \\.\PHYSICALDRIVE0).
3. Partition destruction — Iterates remaining (non-Windows) disks and calls main.unallocateDrive on each. This uses DeviceIoControl with IOCTL_DISK_CREATE_DISK to reinitialise the disk's partitioning metadata, effectively wiping existing partition table entries. On success, the malware prints "Partitions removed successfully." to the console.
4. Raw disk overwrite — Calls main.writeRandToDrive to overwrite each drive in chunks of 0xA00000 bytes (approximately 10 MB). The first byte of each buffer is randomised using crypto/rand.Read; the remaining bytes are zero-filled. If random generation fails, the byte value 0x01 is used instead. This pattern is assessed as a detection-evasion measure against signatures looking for full-disk zeroing.
5. Forced reboot — Invokes Windows shutdown functionality with restart and zero-delay options, forcing an immediate system reboot after wiping completes.

Command structure

The backdoor's ~20 commands fall into three categories:

• Destruction: standalone wiper, ransomware encryption, multi-pass wiping.
• Remote access/monitoring: screen capture, VNC-like remote control, system inventory.
• System management: process management (create/list/kill), service management, registry navigation and mutation, system information collection (hardware, OS, network, firmware, user, antivirus).

Detection names

Malwarebytes detects GigaWiper components as Trojan.FlockWiper and Backdoor.GigaWiper.

Confidence caveat: The attribution of GigaWiper's components to the Crucio ransomware and FlockWiper families is sourced from Malwarebytes Labs (single-sourced for that specific claim; Microsoft's blog does not name these families in the provided excerpts). The C2 IP addresses are sourced from Malwarebytes Labs. Verify before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

• Block C2 infrastructure at network perimeter and egress filters:
• 185.182.193.21
• 212.8.248.104
• Hunt for persistence mechanism — Search all Windows endpoints for scheduled tasks named OneDrive Update: powershell Get-ScheduledTask -TaskName "OneDrive Update" | Format-List * Legitimate OneDrive tasks use names like OneDrive* - TaskSync and similar; a task named exactly OneDrive Update running every minute is anomalous.
• EDR / AV signature update — Ensure detection engines are current. If using Malwarebytes, confirm detection names Trojan.FlockWiper and Backdoor.GigaWiper are active.
• Isolate any compromised hosts — If GigaWiper is identified on a system, isolate immediately. If the wiper has executed, assume irreversible data loss on affected physical disks.

P2 — Within 72 hours

• Deploy behavioural detection rules — See §6 for YARA and Sigma rules targeting GigaWiper artefacts and behaviours.
• Audit scheduled tasks enterprise-wide — Enumerate all scheduled tasks across the estate and flag any with one-minute repetition intervals, particularly those masquerading as legitimate software update tasks.
• Monitor for WMI disk enumeration — Alert on processes issuing WMI queries that enumerate physical disks, especially from unexpected or unsigned Golang-compiled binaries.
• Monitor for DeviceIoControl + IOCTL_DISK_CREATE_DISK — Alert on any process issuing this control code to physical drive handles, which is highly anomalous outside disk management tooling.
• Review initial access vectors — Since GigaWiper is deployed post-compromise, investigate how the attacker gained initial access. Treat any GigaWiper finding as evidence of a broader intrusion.

P3 — Within 7 days

• Backup verification — Verify that offline/immutable backups are current and test restoration procedures. GigaWiper's physical disk wiping is irreversible; backups are the only recovery path.
• Endpoint hardening — Restrict access to raw disk devices (\\.\PHYSICALDRIVE*) using application control / WDAC policies. Legitimate administrative tools can be allowlisted; all other processes should be denied direct disk access.
• Threat hunt for Golang binaries — Search for unstripped Golang-compiled PE files on endpoints, particularly those exhibiting network communication to non-corporate IPs. GigaWiper samples are unstripped, which is unusual for production malware and may aid identification.
• Incident response playbook update — Incorporate GigaWiper-specific indicators and behaviours into destructive-ware IR playbooks. Emphasise that "ransomware" activity may be destructive-only (fake ransomware) with no decryption path.

5. Indicators of compromise

ipv4  185.182.193.21
ipv4  212.8.248.104
scheduled_task  OneDrive Update

Note: IP addresses are defanged in the table per source convention; the plaintext block contains undefanged values for tooling ingestion. These are single-sourced from Malwarebytes Labs — verify before enforcement.

6. Detection

rule GigaWiper_Backdoor_Wiper {
    meta:
        author = "Adverse Trace"
        date = "2026-07-13"
        reference = "https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/"
        description = "Detects GigaWiper backdoor and wiper components by function names and embedded strings"
    strings:
        $func1 = "rabbit_tools_tool_wipe_main.WipeMain" ascii
        $func2 = "main.FindWindowsDrive" ascii
        $func3 = "main.unallocateDrive" ascii
        $func4 = "main.writeRandToDrive" ascii
        $str1 = "Partitions removed successfully." ascii
        $str2 = "OneDrive Update" ascii
        $ioctl = "IOCTL_DISK_CREATE_DISK" ascii
    condition:
        3 of them
}

title: GigaWiper Persistence via OneDrive Update Scheduled Task
id: 7a3c1f2e-4b5d-4a8e-9c1f-2d3e4f5a6b7c
status: experimental
description: Detects creation of a scheduled task named "OneDrive Update" consistent with GigaWiper backdoor persistence
references:

    - https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/
    - https://www.malwarebytes.com/blog/news/2026/07/this-new-windows-malware-can-take-over-your-pc-and-wipe-it-clean
author: Adverse Trace
date: 2026/07/13
tags:

    - attack.persistence
    - attack.t1053.005
    - attack.scheduled_task
logsource:
    product: windows
    category: scheduled_task_creation
detection:
    selection:
        TaskName|contains: "OneDrive Update"
    condition: selection
falsepositives:

    - Legitimate OneDrive update tasks (verify repetition interval — GigaWiper runs every minute)
level: high

title: GigaWiper Wiper Disk Overwrite via DeviceIoControl
id: 8b4d2g3f-5c6e-4b9f-0d2g-3e4f5a6b7c8d
status: experimental
description: Detects processes issuing IOCTL_DISK_CREATE_DISK to physical drive handles, consistent with GigaWiper wiper component
references:

    - https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/
author: Adverse Trace
date: 2026/07/13
tags:

    - attack.impact
    - attack.t1561.002
logsource:
    product: windows
    category: driver_load
detection:
    selection_event:
        EventID: 6
    filter_legitimate:
        Image|startswith:

            - "C:\\Windows\\System32\\"
            - "C:\\Program Files\\"
    condition: selection_event and not filter_legitimate
falsepositives:

    - Legitimate disk management tools (diskpart, format, partition managers)
level: high

7. Sources

• DarkReading — "GigaWiper Lets Threat Actors Choose Their Own Destructive Attack" — https://www.darkreading.com/cyberattacks-data-breaches/gigawiper-threat-actors-choose-their-own-destructive-attack — 2026-07-13
• SecurityWeek — "GigaWiper Combines Multiple Malware for System-Level Sabotage" — https://www.securityweek.com/gigawiper-combines-multiple-malware-for-system-level-sabotage/ — 2026-07 (exact date not specified)
• Microsoft Threat Intelligence — "GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware" — https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/ — 2026-07-09
• Malwarebytes Labs — "This new Windows malware can take over your PC and wipe it clean" — https://www.malwarebytes.com/blog/news/2026/07/this-new-windows-malware-can-take-over-your-pc-and-wipe-it-clean — 2026-07

8. Adverse Trace position

GigaWiper represents a significant evolution in destructive malware: a modular Golang backdoor that gives operators on-demand choice between espionage, fake ransomware, and irreversible physical disk wiping within a single implant. The technical sophistication — WMI-based disk enumeration, IOCTL_DISK_CREATE_DISK partition destruction, randomised overwrite patterns for detection evasion, and forced reboot — indicates a capable developer with knowledge of Windows storage internals. The absence of confirmed CVE data, CISA-KEV exploitation status, or MITRE-attributed threat actor means we cannot currently link GigaWiper to a known campaign or initial-access vector; the C2 IP addresses and malware family attributions (Crucio, FlockWiper) are single-sourced from Malwarebytes Labs and should be verified before enforcement. For EMEA financial services clients, the primary risk is post-compromise deployment: GigaWiper is not an initial-access tool but a finisher. The defence priority is detecting the OneDrive Update scheduled task, blocking the two known C2 IPs, and ensuring offline backups are current — because once the wiper executes, recovery from affected disks is not possible. Adverse Trace will monitor for additional IOCs, attribution updates, and any confirmed initial-access vectors, and will issue a revised advisory if verified data becomes available.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.