GigaWiper Combines Multiple Malware Families into a Single Threat

In October 2025, Microsoft’s threat intelligence team discovered a new malware variant named GigaWiper, which exhibits destructive wiping capabilities within compromised environments. This malware, written in Go, integrates a command-and-control backdoor with multiple built-in destruction features, effectively merging code from at least three older malware families into a single implant. This development marks a significant evolution in wiper malware, which traditionally focused solely on destruction rather than operational efficiency.

GigaWiper operates by communicating with its operators through RabbitMQ for command reception and Redis for result reporting. It maintains persistence via a scheduled task labeled "OneDrive Update," which executes every minute and at system startup. The malware tracks its execution count using a registry key disguised as a OneDrive entry. The command set ranges from 1 to 20, offering an unusually broad array of capabilities for a single implant.

Among its destructive commands, the first command wipes physical disks at a raw level, overwriting content and removing partition metadata from non-Windows drives before forcing a reboot. The second command triggers a Blue Screen of Death, preventing the machine from restarting by deleting critical boot and kernel files. The third command encrypts files with a randomly generated key that is never saved, renaming them with a .candy extension and displaying a threatening image as the wallpaper. Notably, there is no ransom note or recovery option, as the actor does not intend to offer decryption. Command 12 executes a thorough multi-pass wipe of the Windows installation drive, overwriting it with zeros and random bytes.

In addition to its destructive capabilities, GigaWiper includes a comprehensive remote-control suite. Command 20 establishes a VNC-style remote desktop session over TCP, allowing keyboard and mouse control while creating firewall rules named after legitimate Windows components to obscure the traffic. Other commands manage screenshots and continuous screen recording, as well as system information collection and process control, maintaining session state between requests. Command 19 attempts to erase Windows event logs, employing multiple methods to delete Security logs.

The architecture of GigaWiper is particularly noteworthy. Microsoft identified that each of the three main destructive commands is derived from separate, previously existing malware families developed by the same threat actor. Command 3, which mimics ransomware behavior, is based on the Crucio ransomware code documented in a CISA advisory in December 2023. Command 12, the multi-pass secure wipe, is a Go reimplementation of FlockWiper, a C-based wiper that first appeared on VirusTotal in June 2025. The similarities in logic and function names between GigaWiper and its predecessors suggest a deliberate evolution of the threat actor's tools.

The standalone disk wiper command is an exact replica of a previously observed wiper binary, indicating that the same code is utilized within the backdoor. This modular structure alters the defensive landscape, as GigaWiper can maintain persistence and switch between intelligence-gathering and destructive operations without requiring the deployment of new tools.

The command-and-control infrastructure associated with GigaWiper has been observed using specific IP addresses and ports for command delivery and result reporting. The RabbitMQ fanout exchange broadcasts commands to all infected hosts, while a topic exchange allows for targeted commands to specific machines.

Microsoft concludes that GigaWiper represents a significant advancement in malware capabilities, allowing threat actors to maintain control over infected systems and execute commands while also being able to trigger destructive actions on demand. This evolution underscores the need for organizations to implement robust security measures, including tamper protection, endpoint detection and response in block mode, and cloud-delivered protection to counter rapidly evolving threats. Immediate actions include blocking access to the identified command-and-control infrastructure.