GigaWiper: Anatomy of a Destructive Backdoor That Unites Three Malware Families

On July 9, 2026, Microsoft Threat Intelligence went public with a piece of malware that captures an uncomfortable trend: GigaWiper, a Windows backdoor written in Golang that bundles three independent malware families as on-demand commands within a single implant. It encrypts, wipes and spies, but does none of it to extort a ransom. The goal is pure destruction, disguised as ransomware. This article dissects its structure, command and control, and defense, and shows why no patch helps against such a post-compromise weapon: only visibility does.

What GigaWiper is, and what is new about it

Microsoft identified GigaWiper in October 2025 after destructive wiping activity had been observed in compromised environments. What stands out is not a single brilliant technique but the consolidation: instead of deploying several tools one after another, the actor has fused existing malware into commands within one backdoor. The implant is an unstripped Golang PE that accepts roughly 20 commands over a dual command-and-control channel, ranging from harmless reconnaissance to the irreversible destruction of the disk.

Microsoft frames the development like this: bundling multiple destructive capabilities into a modular backdoor is a notable shift for wiper malware, which is usually built purely for destruction rather than extortion. Exactly this modularity gives the attacker the choice of how to destroy, and makes classification harder for defenders, because the same implant can look like ransomware, like spyware or like a sabotage tool.

The three destruction paths in detail

GigaWiper gives the attacker not one but several independent methods to render a system unusable. Each comes from a different source and leaves a different picture behind.

The physical disk wiper (command 1) enumerates the physical drives via WMI, identifies the Windows drive and removes the partition metadata on the remaining drives via DeviceIoControl and IOCTL_DISK_CREATE_DISK. It then overwrites the disks in blocks of 0xA00000 bytes, setting only the first byte to a random value and zeroing the rest, and forces an immediate reboot. Precisely this pattern, which differs from a plain full zeroing, can slip past simple signature-based detection.

The fake ransomware (command 3, RanMain/BigBangExtortMain) takes a function straight from the Crucio ransomware family. It encrypts files with AES in CBC mode, appends the .candy extension and drops a wallpaper (image_danger.jpg) in ransomware style. The decisive difference from real ransomware: the keys are generated randomly and never stored, and there is no ransom note. The encryption is therefore final, a wiper in a ransomware costume.

The FlockWiper reimplementation (command 12, WipeCMain) is a Golang port of FlockWiper, originally written in C (first observed on VirusTotal in June 2025). It specifically wipes the Windows drive with a multi-stage secure procedure that alternates between zeros, 0xFF and random bytes. FlockWiper samples reference PDB paths such as A:\GRAT\CWipeNew\Release\CWipeNew.pdb, a clue that, together with the function name BigBangExtortMain, supports the link to the Crucio actor.

Command and control: hidden in legitimate traffic

The most interesting part from a defender's perspective is how GigaWiper talks to its operator. Instead of ordinary HTTP or HTTPS requests, which web proxies and URL filters would see, the backdoor rides on real business services: RabbitMQ (AMQP) for tasking, Redis for reporting results back and MinIO for file exfiltration. Through a fanout exchange named "All", commands can be sent to all implants at once; through a topic exchange named "Topic", to individual ones.

This choice is deliberate: RabbitMQ, Redis and MinIO are legitimate building blocks in many environments. Traffic to them does not necessarily stand out to signature- and domain-based detection. It does become visible to behavioral network analysis, which asks whether a given endpoint normally talks to a message broker, at what times and in what volume. This is exactly where NDR comes in.

Disguised as OneDrive: persistence and obfuscation

To remain persistent and inconspicuous, GigaWiper poses as Microsoft OneDrive. It uses PowerShell to create a scheduled task named "OneDrive Update" that runs every minute and at system startup, and tracks its own execution through a counter in the registry key HKCU\SOFTWARE\OneDrive\Environment. Because this path lives in the user context, the initial persistence requires no administrative privileges.

For remote access (command 20, a VNC-style remote desktop control), the backdoor creates firewall rules that reference Microsoft.Windows.CloudExperienceHost to blend into legitimate Windows traffic. And with command 19 it deletes the event logs for System, Setup, Application, ForwardedEvents and Security via wevtutil.exe to cover its tracks. An attacker deleting logs is itself a strong signal, provided someone sees it before it is too late.

Not just destruction: reconnaissance and espionage

GigaWiper is more than a wiper. Before destroying, it can perform extensive reconnaissance and surveillance. Command 15 (GRATClientInfo) collects the IP address, machine GUID, CPU, OS version and build, network configuration, firmware information, local user accounts and the installed antivirus product (via a PowerShell query against root\SecurityCenter2). Added to that are screenshots per monitor (command 9), screen recording while the system is active and not idle (command 10) and a function intended for keystroke capture (command 11). Process, service and registry management (commands 16 to 18) round out the remote control.

Attribution: the trail to Crucio and "GRAT"

Microsoft attributes GigaWiper to the same actor behind the Crucio ransomware, which was the subject of a CISA advisory in December 2023. The evidence is concrete: shared source code between the Crucio encryption command and the ransomware, the identical function name BigBangExtortMain and PDB references to an internal framework named GRAT that appears in both FlockWiper samples and GigaWiper. Microsoft does not name a specific geographic victim group, but the capabilities point to broadly deployable, destructive campaigns.

Why no patch helps, and what works instead

The most important sentence from Microsoft's analysis, paraphrased: because this is malware and not a single vulnerability, there is no patch to chase. GigaWiper is what an attacker executes after already being inside. Defense therefore shifts from "close the gap" to "detect initial access and lateral movement early" and "ensure recoverability". Microsoft recommends tamper protection, always-on real-time protection, EDR in block mode, attack surface reduction, blocking known C2 infrastructure and automated investigation. Translated into a layered, sovereign defense, that means:

Indicators of Compromise (IOCs)

Complete and continuously updated IOC lists, including Microsoft Defender detection names, are available in the linked Microsoft Security Blog. The C2 addresses should be blocked where possible.

Frequently asked questions