Microsoft Unveils GigaWiper Malware Combining Espionage and Destruction

Microsoft has recently discovered a new malware dubbed GigaWiper, which signifies a dangerous evolution in cyber-attack frameworks. This multi-purpose backdoor is linked to a malware implant that enables cyber threat actors to engage in both covert espionage and destructive wiping operations. GigaWiper is equipped with various wiping functionalities, including a file-encrypting ransomware variant that renders files irretrievable.

The malware's design merges these functionalities into a single robust backdoor, providing attackers with enhanced control over infected systems. GigaWiper allows cybercriminals to execute commands, deploy additional tools, and trigger multiple destructive commands at will.

Microsoft Security published an analysis on July 9, revealing that GigaWiper was created by reimplementing components from at least three previously distinct malware families, including the Crucio ransomware strain and FlockWiper. The malware was first detected in October 2025, when Microsoft Threat Intelligence observed compromised environments being wiped using destructive tools.

While specific details about the targeted systems or victims remain undisclosed, researchers identified a versatile implant written in the Go programming language (Golang). This implant combines strong command-and-control capabilities with various destructive payloads, such as disk wiping, fake ransomware, and system sabotage.

Microsoft's analysis noted that GigaWiper exemplifies a notable shift in wiper malware, which traditionally focused solely on destruction rather than extortion. The consolidation of multiple destructive capabilities into a modular backdoor reflects an investment by threat actors in operational efficiency, merging standalone tools into unified platforms that enhance their destructive potential while minimizing deployment complexity.

To help organizations mitigate the threats posed by GigaWiper, Microsoft researchers have provided several recommendations, including specific mitigation strategies tailored to Microsoft products.