Microsoft Uncovers GigaWiper Malware That Destroys PCs

Microsoft has discovered a new malware known as GigaWiper, which poses a significant threat by not only spying on data but also rendering entire systems inoperable. Detected by Microsoft Threat Intelligence in October 2025, GigaWiper is more than just a traditional wiper malware; it integrates multiple destructive functions with a powerful backdoor for attackers. Other security researchers refer to it as BlueRabbit.

One of GigaWiper's most alarming features is its capability to overwrite hard drives at a low level, directly accessing physical drives rather than simply deleting files. This allows it to remove partition entries and overwrite data, making recovery nearly impossible. Additionally, GigaWiper masquerades as ransomware by encrypting files and appending the .candy extension, but unlike typical ransomware, the decryption keys are generated randomly and not stored, rendering recovery futile.

The malware also overwrites the Windows system drive multiple times with various data patterns, further complicating recovery efforts. Beyond its destructive capabilities, GigaWiper serves as a backdoor, enabling attackers to gain permanent access to infected systems. This allows them to gather information or take control before initiating destructive actions.

GigaWiper establishes a scheduled task in the Windows Task Scheduler named "OneDrive Update," which runs regularly and can easily be overlooked. It communicates with command-and-control servers using RabbitMQ and Redis, making detection challenging in corporate networks where these services are common.

The structure of GigaWiper incorporates components from older malware strains, including Crucio and FlockWiper, integrated into a new backdoor developed in the Go programming language. This design gives attackers the flexibility to control systems, manipulate data, or trigger complete destruction.

Currently, GigaWiper appears to be primarily targeting organizations and corporations, with no evidence of widespread distribution among home Windows users. For home users, maintaining traditional security measures is essential, including keeping Windows and security software updated and avoiding unsolicited attachments and applications.

Microsoft recommends that businesses enable protective features like tamper protection for security software, deploy modern attack detection systems, and monitor for suspicious activities such as unusual tasks in the Windows Task Scheduler or unexpected network connections. Regular backups are crucial and should be stored separately from the PC to ensure recovery in the event of a genuine wiper attack.