GigaWiper Malware Threatens Data Security with Destructive Capabilities

Microsoft Threat Intelligence has uncovered GigaWiper, a dangerous malware that combines destructive capabilities with extensive surveillance features. Discovered in October 2025, GigaWiper functions as a backdoor, allowing remote control over infected systems while also being equipped to wipe data from hard drives. The malware is written in Go and includes three primary data-wiping methods. The first is a standalone wiper that operates at the physical disk level, overwriting data without regard for file or partition metadata. The second method is a fake ransomware module derived from the Crucio malware family, which encrypts files without saving the encryption key, rendering recovery impossible. The third method replicates the logic of FlockWiper, capable of securely erasing the Windows system drive through a multi-pass process.

In addition to its destructive capabilities, GigaWiper supports 20 different commands issued from a command-and-control (C2) server, posing serious security threats to users and organizations alike. Its surveillance functionalities include capturing screenshots and recording video, with the ability to stream a live feed of the user's screen while allowing remote keyboard and mouse input. This malware employs TCP-based streaming and uses custom exceptions in the Windows Firewall to conceal its activities.

GigaWiper also offers monitoring and management capabilities, collecting detailed information about the infected machine and its software environment. It can manage software processes, Windows event logs, and the system registry. Microsoft has linked GigaWiper's code to at least three separate malware families, including Crucio and FlockWiper, based on shared execution flow and function naming.

To protect against GigaWiper, Microsoft recommends organizations enable tamper protection in Microsoft Defender and activate cloud-based protection to detect evolving threats before local virus signatures are updated. This malware represents a significant risk, and proactive measures are essential to safeguard data and systems.