This new Windows malware can take over your PC and wipe it clean

1. Executive summary

Microsoft Threat Intelligence has published detailed research on GigaWiper, a modular Golang-based Windows backdoor observed in intrusions since October 2025. GigaWiper consolidates at least three previously separate malware families — Crucio ransomware, a Go reimplementation of FlockWiper, and a standalone disk wiper — into a single implant offering ~20 commands across destruction, remote access/monitoring, and system management categories. The malware provides full remote control (screen capture, VNC-like desktop streaming, keyboard/mouse input), espionage capabilities, and multiple irreversible data-destruction paths including raw disk wiping, fake ransomware with discarded keys, and multi-pass Windows drive overwrites. No CISA-KEV exploitation state, CVSS score, or specific CVE is associated with this item — GigaWiper is deployed post-compromise as a tool, not an exploit. EMEA financial services organisations with Windows estates face severe operational impact if this implant is executed: total data loss on affected endpoints and potential lateral spread via its remote-access and system-management capabilities.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain (corroborated by Microsoft, The Register, Malwarebytes, SecurityWeek, The Hacker News)

1. Initial compromise (pre-GigaWiper): GigaWiper is deployed after attackers have already gained access to a target system. The initial access vector is not specified in the available source material. Microsoft states the best defence is preventing the initial intrusion and detecting malicious activity before destructive commands execute.
2. Implant execution: Two sample types have been observed, both unstripped portable executable (PE) files written in Golang: - A standalone wiper PE. - A larger backdoor PE that fully embeds the standalone wiper's code as one of its commands (implemented as rabbit_tools_tool_wipe_main.WipeMain).
3. Persistence: The backdoor creates a Windows scheduled task named "OneDrive Update" that runs every minute and at startup to maintain persistence.
4. Command-and-control: C2 communication uses RabbitMQ over AMQP for receiving commands from the C2 server, and Redis for updating command status and output. Two C2 server IPs identified: - 185.182.193[.]21 - 212.8.248[.]104
5. Command execution (~20 commands across three categories):

Destruction commands:

• Raw disk wiper: Enumerates physical disks via WMI, identifies the Windows installation drive via main.FindWindowsDrive (e.g., \\.\PHYSICALDRIVE0), removes partition references on non-Windows drives using DeviceIoControl with IOCTL_DISK_CREATE_DISK (console output: "Partitions removed successfully"), then overwrites each drive in chunks of 0xA00000 bytes via main.writeRandToDrive. The first byte of each buffer is randomised using crypto/rand.Read; remaining bytes are zero-filled. If random generation fails, byte value 0x01 is used. Forces immediate reboot via Windows shutdown with restart and zero-delay options.
• Fake ransomware (Crucio-based): Encrypts files with randomly generated keys that are never saved, making decryption impossible. Masquerades as ransomware but no payment is demanded — the intent is destruction, not extortion.
• Windows drive secure wiper: Targets the Windows installation drive specifically and performs multi-pass overwrites using different byte patterns.
• System sabotage command: Disables Windows recovery, triggers a blue screen of death (BSOD), and leaves the device unable to boot.

Remote access / monitoring commands:

• Screen capture: One-shot screenshots of each monitor; continuous recording while the user is active.
• Remote control: TCP server that streams the desktop and allows keyboard and mouse input. Creates its own Windows Firewall exceptions to enable inbound access.
• File exfiltration: Uses MinIO Client (mc) to upload stolen files to remote storage.
• Bulk file encryption/decryption: AES-256 in CBC mode for bulk encrypt or decrypt operations.

System management commands:

• Process manager: Create, list, or kill processes.
• Service manager: Manage Windows services.
• Registry manager: Navigate and mutate registry keys.
• System information collection: Hardware, OS, network, firmware, user, and antivirus details.
• PowerShell execution: Runs arbitrary PowerShell commands.
• Event log clearing: Clears Windows event logs.
• Command categories: "always run" (e.g., continuous screen recording), "manage command" (system management), "special command" and "shell command" modes.

Attribution: No threat actor has been named by Microsoft or any other source. No MITRE ATT&CK actor profile is available. Attribution is unconfirmed.

Confidence caveat: The technical detail above is primarily single-sourced to Microsoft Threat Intelligence's blog post, with corroboration from The Register, Malwarebytes, SecurityWeek, and The Hacker News on high-level characteristics (modular structure, component malware families, destructive capabilities). The code-level analysis (function names, WMI queries, IOCTL usage, chunk sizes, crypto details) rests solely on Microsoft's report — verify before enforcement at the code level.

4. Mitigation & containment

P1 — Within 24 hours

• Block C2 infrastructure at perimeter firewall, proxy, and DNS sinkhole:
• 185.182.193.21
• 212.8.248.104
• Hunt for persistence indicator: Search all Windows endpoints for a scheduled task named OneDrive Update. Remove if confirmed malicious. PowerShell: powershell Get-ScheduledTask -TaskName "OneDrive Update" | Select-Object TaskName, State, Author, Actions Legitimate OneDrive tasks use names like OneDrive* Standalone Update Task* — the exact string OneDrive Update with per-minute triggers is the indicator.
• Block AMQP egress (TCP 5671/5672) from workstations and servers to external addresses unless explicitly required for business operations. GigaWiper uses RabbitMQ over AMQP for C2.
• Isolate any detected GigaWiper infections immediately from the network to prevent destructive command execution. Do NOT attempt remediation while the host is network-connected — the operator can trigger wiping remotely.
• Enable tamper protection on all endpoint security products to prevent local admin or malware from disabling anti-malware controls.

P2 — Within 72 hours

• Deploy EDR detections for:
• Raw disk access via DeviceIoControl with IOCTL_DISK_CREATE_DISK from non-standard processes.
• Processes writing directly to \\.\PHYSICALDRIVE* device paths.
• Creation of Windows Firewall rules by non-standard processes (GigaWiper creates its own exceptions for remote control TCP server).
• Execution of mc.exe (MinIO Client) from unexpected locations.
• Bulk event log clearing via wevtutil cl or equivalent from non-admin tooling.
• Audit and restrict outbound Redis connections (TCP 6379) from endpoint subnets.
• Verify offline/immutable backup integrity — GigaWiper's destruction is irreversible; recovery depends entirely on backup availability. Confirm backup isolation from the production network.
• Review Windows recovery configuration: Monitor for unauthorised changes to Windows Recovery Environment (WinRE) settings and reagentc usage.
• Deploy vendor detections: Malwarebytes detects GigaWiper components as Trojan.FlockWiper and Backdoor.GigaWiper. Microsoft Defender detections are referenced in Microsoft's blog (specific signature names not quoted in available source material).

P3 — Within 7 days

• Conduct threat-led purple team exercise simulating post-compromise wiper deployment to validate detection and response timelines.
• Review credential hygiene: Rotate credentials for any accounts that may have been compromised in the initial intrusion phase. Review logs for privilege escalation and lateral movement.
• Implement application allow-listing for mc.exe and similar file-transfer utilities on server estates.
• Harden scheduled task monitoring: Alert on any scheduled task created with a per-minute trigger, especially those masquerading as legitimate software update tasks.

5. Indicators of compromise

ipv4  185.182.193.21
ipv4  212.8.248.104
scheduled_task  OneDrive Update
detection_name  Trojan.FlockWiper
detection_name  Backdoor.GigaWiper

6. Detection

rule GigaWiper_Backdoor_Wiper {
  meta:
    author = "Adverse Trace"
    date = "2026-07-10"
    reference = "https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/"
    description = "Detects GigaWiper backdoor and standalone wiper components based on function names and strings from Microsoft code-level analysis"
    tlp = "AMBER"

  strings:
    $func1 = "rabbit_tools_tool_wipe_main.WipeMain" ascii
    $func2 = "main.FindWindowsDrive" ascii
    $func3 = "main.unallocateDrive" ascii
    $func4 = "main.writeRandToDrive" ascii
    $console1 = "Partitions removed successfully" ascii
    $task1 = "OneDrive Update" ascii
    $ioctl = "IOCTL_DISK_CREATE_DISK" ascii

  condition:
    3 of them
}

title: GigaWiper Persistence via OneDrive Update Scheduled Task
id: 7a3c1f2e-4b5d-4a8e-9c1f-0a6b2c3d4e5f
status: experimental
description: Detects creation of a scheduled task named "OneDrive Update" consistent with GigaWiper backdoor persistence
references:

  - https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/
  - https://www.malwarebytes.com/blog/news/2026/07/this-new-windows-malware-can-take-over-your-pc-and-wipe-it-clean
author: Adverse Trace
date: 2026/07/10
tags:

  - attack.persistence
  - attack.t1053.005
logsource:
  product: windows
  category: process_creation
detection:
  selection_schtasks_create:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains|all:

      - '/create'
      - 'OneDrive Update'
  condition: selection_schtasks_create
falsepositives:

  - Legitimate OneDrive update tasks (verify trigger frequency — legitimate tasks do not run every minute)
level: high

title: GigaWiper C2 Communication to Known Infrastructure
id: 8b4d2g3f-5c6e-4b9f-0d2g-1b7c3d4e5f6a
status: experimental
description: Detects network connections to GigaWiper C2 servers over AMQP or any protocol
references:

  - https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/
author: Adverse Trace
date: 2026/07/10
tags:

  - attack.command_and_control
  - attack.t1071
logsource:
  product: windows
  category: network_connection
detection:
  selection_c2:
    DestinationIp:

      - '185.182.193.21'
      - '212.8.248.104'
  condition: selection_c2
falsepositives:

  - None expected; IPs are dedicated C2 infrastructure
level: critical

title: GigaWiper Raw Disk Wipe via DeviceIoControl
id: 9c5e3h4g-6d7f-4c0a-1e3h-2c8d4e5f6a7b
status: experimental
description: Detects processes issuing IOCTL_DISK_CREATE_DISK to raw physical drive handles, consistent with GigaWiper's partition destruction
references:

  - https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/
author: Adverse Trace
date: 2026/07/10
tags:

  - attack.impact
  - attack.t1561.002
logsource:
  product: windows
  category: file_access
detection:
  selection_device:
    TargetFilename|startswith: '\\.\PHYSICALDRIVE'
  filter_legitimate:
    Image|startswith:

      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
  condition: selection_device and not filter_legitimate
falsepositives:

  - Disk management utilities, backup software performing raw disk operations
level: high

7. Sources

• Microsoft Threat Intelligence — "GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware" — https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/ — 2026-07-09
• The Register — "Destructive Windows backdoor stuffs multiple wipers and ransomware code into a single package" — https://www.theregister.com/security/2026/07/10/destructive-windows-backdoor-stuffs-multiple-wipers-and-ransomware-code-into-a-single-package/5270053 — 2026-07-10
• Malwarebytes — "This new Windows malware can take over your PC and wipe it clean" — https://www.malwarebytes.com/blog/news/2026/07/this-new-windows-malware-can-take-over-your-pc-and-wipe-it-clean — 2026-07-10
• SecurityWeek — "GigaWiper Combines Multiple Malware for System-Level Sabotage" — https://www.securityweek.com/gigawiper-combines-multiple-malware-for-system-level-sabotage/ — 2026-07-10
• The Hacker News — "New GigaWiper Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware" — https://thehackernews.com/2026/07/new-gigawiper-windows-backdoor-bundles.html — 2026-07-10

8. Adverse Trace position

Severity: Critical. GigaWiper represents a high-impact threat to EMEA financial services Windows estates. Its combination of long-term remote access (screen capture, VNC-like control, system inventory) with multiple irreversible destruction paths (raw disk wipe, fake ransomware with discarded keys, multi-pass Windows drive overwrite, BSOD/recovery disable) means that a single successful deployment can result in total endpoint data loss with no recovery option beyond offline backups. The malware is not an exploit — it is a post-compromise tool — so existing patch posture is irrelevant; detection and response capability is the decisive control. The code-level technical detail is single-sourced to Microsoft Threat Intelligence; we assess the high-level characteristics as well-corroborated across five independent sources but recommend independent verification of function-name and IOCTL-level indicators before committing to automated blocking rules. No threat actor attribution has been confirmed. We will continue monitoring for attributed campaigns, additional IOCs, and any initial-access vector disclosures. Clients should prioritise P1 network blocking and scheduled-task hunting immediately.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.