**GigaWiper: A Three-Pronged Windows Backdoor Disguised as Ransomware**
In a recent analysis, Microsoft has dissected a sophisticated Windows backdoor dubbed **GigaWiper**. What makes this threat particularly insidious is its construction—it is not a single piece of malicious software, but rather three older destructive programs welded together. The operator can choose from a menu of commands to inflict different types of damage on an already compromised system.
The capabilities are severe: the malware can either wipe an entire hard disk, overwrite the Windows drive with new data patterns, or deploy a fake “ransomware” that encrypts files with a key the attacker never saves, rendering the files permanently inaccessible without any possibility of recovery. Because GigaWiper is an active attacker tool rather than an exploit, there is no patch available. Defense therefore relies on early detection practices and maintaining clean, offline backups.
Interestingly, the same malicious files have been identified by security firm Binary Defense under a different name: **BLUERABBIT**. Both reports point to the same command and control infrastructure. According to Binary Defense, citing Google’s Threat Intelligence Group, the malware is likely associated with an Iran-aligned group targeting Israeli organizations. Microsoft has not publicly attributed the activity to any specific nation-state.
**Three Methods of Destruction**
Written in the Go programming language for Windows, GigaWiper accepts numeric commands to control its behavior. Three of these commands are dedicated to destruction, each employing a unique method:
1. **Disk Wiping:** A raw command overwrites the physical drive, including the partition table, directly destroying the data. Recovery is impossible without backups.
2. **Fake Ransomware:** Based on older code known as Crucio, this mode encrypts files and appends a `.candy` extension, changing the desktop wallpaper to a warning screen. However, it leaves no ransom note or decryption key. This is purely destructive masquerading as extortion.
3. **Drive Overwriting:** This targets the Windows drive specifically, overwriting it multiple times with different data patterns. Microsoft notes this is a rewrite of their previously tracked **FlockWiper** malware.
Because the keys are never saved and the partitions are destroyed, there is no way to reverse the damage, making clean backups the only viable recovery method.
**Surveillance and Evasion**
Beyond destruction, GigaWiper functions as a full-featured remote access trojan (RAT). It can monitor the victim’s activity by taking screenshots, recording screen sessions, and opening a hidden VNC channel to allow remote mouse and keyboard control. It also collects system information, manages running processes, edits the registry, and can even wipe Windows event logs to erase its presence.
To remain hidden, the malware masquerades as a legitimate **OneDrive** process, creating a scheduled task named “OneDrive Update” that runs every minute. It hides its network communications by piggybacking on legitimate business protocols like RabbitMQ, Redis, and MinIO, making the traffic blend in with normal network activity. It also creates a firewall rule named after a real Windows component, `Microsoft.Windows.CloudExperienceHost`, to further disguise its command channel.
**Origins and Context**
Microsoft’s analysis traces the ransomware module back to the **Crucio** code, which is linked to a group known as **CyberAv3ngers**, associated with Iran’s Islamic Revolutionary Guard Corps (IRGC). This aligns with reports from earlier this year regarding water and energy sector breaches in the US, UK, Israel, and Ireland. The same fingerprint found in the GigaWiper samples was seen in attacks on critical infrastructure.
Microsoft notes a recurring tag, “GRAT,” connecting GigaWiper to another tool called FlockWiper, suggesting a shared developer or component library. While the timing of attacks varies slightly between sources—Microsoft dates the activity to October 2025, while Binary Defense first saw the samples in March 2026—the consensus points to an active and ongoing offensive.
This development is part of a larger wave of wiper attacks attributed to Iranian-affiliated actors. As these groups continue to refine their tactics, the line between espionage, sabotage, and extortion becomes increasingly blurred.
**Defensive Measures**
Security experts recommend looking for specific anomalies to detect GigaWiper:
* Monitor for recurring “OneDrive Update” scheduled tasks.
* Look for unexpected RabbitMQ or Redis traffic on standard desktop machines.
* Watch for the use of administrative tools like `takeown` and `icacls` on boot files outside of maintenance windows.
On the prevention side, Microsoft advises enabling tamper protection in antivirus solutions, blocking the known command server IPs, utilizing endpoint detection and response (EDR) tools in block mode, and ensuring cloud-delivered protection is active.
***
**Original Article:** *Microsoft Details Destructive ‘GigaWiper’ Windows Backdoor, Disguised As Ransomware Using Old Malware* by Sean Michael Kerner, **This Week in Security** (September 29, 2026).
https://www.thehackertimes.com/microsoft-details-destructive-gigawiper-windows-backdoor-disguised-as-ransomware-using-old-malware/
