A Sophisticated Threat Actor’s Tool of Choice: GigaWiper
Microsoft has been tracking a highly destructive malware, dubbed GigaWiper, that has been wreaking havoc on Windows systems for over eight months. This sophisticated threat combines multiple malware families and boasts robust command-and-control (C&C) capabilities, making it a powerful tool in the hands of a skilled threat actor.
GigaWiper is a Go-based backdoor that operates at the system level, allowing its operator to execute various destructive commands on demand. These include wiping entire drives, triggering a Blue Screen of Death (BSOD), and uploading files to remote servers using MinIO Client. The malware also has the ability to encrypt files in bulk or decrypt them for ransom, as well as collect system information, take screenshots, and record the screen.
One of the most alarming features of GigaWiper is its ability to operate at the physical disk level, effectively erasing entire drives and rebooting the system. This is achieved through a wiper component that uses Windows Management Instrumentation (WMI) to identify the Windows partition and then removes partition references from non-Windows drives before wiping each drive.
The backdoor component of GigaWiper is equally impressive, with its own set of destructive capabilities, including identical code flow and function names. It establishes persistence and C&C communication using RabbitMQ and Redis, allowing the threat actor to maintain control over infected systems and execute commands at will.
Microsoft notes that GigaWiper’s consolidation of multiple destructive capabilities into a modular backdoor reflects a notable shift in wiper malware, which is typically designed purely to destroy rather than extort. The fact that this malware has been observed in the wild for so long suggests that its operator is highly skilled and motivated.
The connections between GigaWiper and other malware families are also worth noting. Its encryption code bears similarities to that used by the Crucio ransomware developer, while its wiping function shares an identical implementation with FlockWiper, which emerged in June 2025. This suggests a level of sophistication and coordination among threat actors that is becoming increasingly concerning.
For system administrators and security professionals, GigaWiper serves as a stark reminder of the importance of staying vigilant and up-to-date on the latest threats. In an era where malware is becoming increasingly sophisticated and destructive, it’s essential to have robust defenses in place, including regular backups, secure configurations, and thorough threat intelligence.
To mitigate the risk of falling victim to GigaWiper or similar threats, we recommend that organizations prioritize patch management, implement robust network segmentation, and conduct regular security audits. Additionally, staying informed about the latest threats and best practices will help system administrators make informed decisions and stay one step ahead of the attackers.
Source: SecurityWeek — 2026-07-10