A New Breed of Malware Lets Attackers Choose Their Own Destructive Path
In a disturbing development that highlights the evolving tactics of cyber threat actors, researchers have uncovered a novel modular malware that allows attackers to choose how they want to destroy a targeted system. Dubbed GigaWiper, this malware combines multiple malware capabilities into a single implant, giving attackers the flexibility to maximize their impact while minimizing their operational footprint.
GigaWiper was initially spotted during “destructive wiper activity” in October 2025, where researchers thought they were looking at a Golang-based backdoor. However, upon closer inspection, it became clear that GigaWiper was something more sinister – a versatile implant that combines robust command-and-control (C2) capabilities with multiple destructive payloads, including disk wiping, fake ransomware, and system-level sabotage.
The malware’s design reflects a notable shift in wiper malware, which are typically used for destructive attacks designed to encrypt or delete systems’ data with no option for recovery. Traditional wipers are often “fire-and-forget” tools, where the attacker deploys the wiper and detonates it, causing destruction as the primary goal of the intrusion. GigaWiper flips this model on its head by providing persistent access, remote control, reconnaissance, and command execution capabilities long before a destructive payload is triggered.
This allows attackers to spend time inside an environment, understand critical systems, and choose the most damaging action at the optimal moment. For security teams, this means shifting their focus from detecting the wiping event itself to identifying earlier signs of compromise in the system.
GigaWiper’s backdoor supports roughly 20 commands covering activities such as remote shell execution, file management, process control, system reconnaissance, screenshot capture, and hidden remote desktop sessions. This gives attackers extensive operational capabilities that allow them to control infected systems and deploy additional tooling before launching any disruptive actions.
The malware has been identified by Microsoft as having three destructive modules designed to give organizations little chance of recovering the destroyed data and assets. These include a raw disk wiper that overwrites physical disks and destroys partition information, fake ransomware derived from the Crucio ransomware family that encrypts files using random keys that are intentionally discarded, and a multipass secure wiper based on FlockWiper that repeatedly overwrites files to hinder forensic recovery.
The C2 infrastructure of GigaWiper also demonstrates modularity, with operators using RabbitMQ, an Advanced Message Queuing Protocol (AMQP) implementation, to receive commands from the C2 server. This level of sophistication and flexibility makes GigaWiper a particularly worrying development in the world of cyber threats.
For organizations, this highlights the importance of being prepared for all types of attacks, not just traditional wipers. By understanding the potential capabilities of malware like GigaWiper, businesses can take steps to mitigate the risks and ensure that their systems are secure against these types of threats. This includes investing in robust security measures such as intrusion detection and response, regular backups, and employee education on cybersecurity best practices.
Source: Dark Reading — 2026-07-13