Microsoft has revealed details about a new Windows backdoor called GigaWiper, a sophisticated malware platform designed not just to spy on infected systems but also to completely destroy them.
Unlike traditional malware that performs a single function, GigaWiper combines three destructive tools into one platform, allowing attackers to choose how they want to disable a compromised machine. Since it operates after attackers have already gained access, there is no software patch that can prevent it. Instead, organizations must focus on early threat detection, strong endpoint security, and reliable offline backups.
GigaWiper and BLUERABBIT: The Same Malware?
Researchers believe GigaWiper is the same malware previously identified as BLUERABBIT by Binary Defense.
Both security teams identified identical malware hashes and command-and-control (C2) infrastructure, suggesting they are analyzing the same threat under different names. According to Binary Defense, citing Google’s Threat Intelligence Group, the malware is likely linked to an Iran-associated threat actor targeting Israeli organizations. Microsoft, however, has not publicly attributed the campaign to any specific country.
Three Built-In Methods to Destroy Windows Systems
Developed in Go (Golang), GigaWiper accepts commands from attackers and includes three separate destructive modules.
1. Complete Disk Wiper
The first module directly overwrites the physical hard drive and destroys the partition table.
Rather than deleting files individually, it erases the entire disk structure, making recovery nearly impossible without backups.
2. Fake Ransomware
The second component is based on older malware known as Crucio.
It encrypts files, appends a .candy extension, and replaces the desktop wallpaper with what appears to be a ransomware warning. However, unlike genuine ransomware, it never stores the encryption key or provides a ransom note.
This means victims cannot recover their files—even if they wanted to pay.
3. Windows Drive Wiper
The final destructive feature repeatedly overwrites the Windows system drive using multiple data patterns.
Microsoft says this component is a rewritten version of another destructive malware family it tracks as FlockWiper.
The objective is simple: permanently disable the system rather than generate financial profit.
More Than Just a Wiper
GigaWiper is not solely focused on destruction. It also functions as a full-featured backdoor that gives attackers extensive control over compromised devices.
Its capabilities include:
- Capturing screenshots from all connected monitors
- Recording users’ screens
- Opening hidden VNC remote-control sessions
- Collecting detailed system information
- Managing running processes and Windows services
- Editing Windows Registry settings
- Clearing Windows Event Logs to hide malicious activity
Microsoft also discovered dormant code that could enable additional functionality in future versions, including a keylogger and extra wiping features.
Stealth Techniques Help It Avoid Detection
To remain hidden, GigaWiper disguises itself as legitimate Windows components.
Some of its persistence and evasion techniques include:
- Creating a scheduled task called OneDrive Update that runs every minute
- Storing persistence information under the registry path:
HKCU\SOFTWARE\OneDrive\Environment - Creating firewall rules using the name of the legitimate Windows process Microsoft.Windows.CloudExperienceHost
Instead of relying on custom malware communication channels, GigaWiper uses legitimate enterprise technologies such as:
- RabbitMQ
- Redis
- MinIO
Because these services are commonly used in business environments, malicious network traffic can blend in with normal operations, making detection significantly more difficult.
Tracing GigaWiper’s Origins
Microsoft believes GigaWiper combines code from two previously known malware families:
- Crucio, which provides the fake ransomware functionality
- FlockWiper, which powers the destructive disk wiping capability
Researchers also found the recurring tag “GRAT” within both malware families, suggesting they were developed by the same threat actor or development team.
Although Microsoft has not attributed the campaign to a specific nation, Crucio previously appeared in a 2023 CISA advisory related to CyberAv3ngers, a hacking group associated with Iran’s Islamic Revolutionary Guard Corps (IRGC).
Binary Defense first detected the malware in March 2026 under the name BLUERABBIT, while Microsoft links destructive attacks involving GigaWiper to October 2025.
A Growing Trend in Destructive Cyberattacks
Cybersecurity researchers have observed increasing use of destructive malware in attacks targeting Israeli organizations throughout 2025 and 2026.
Security firms, including Palo Alto Networks’ Unit 42, have reported similar campaigns conducted by groups such as Handala Hack, while Israel’s National Cyber Directorate has warned organizations about ongoing Iranian wiper attacks.
The strategy itself is not new.
The infamous NotPetya attack in 2017 also disguised itself as ransomware while actually functioning as a data wiper. By appearing to be ransomware, attackers delay incident response as victims initially believe recovery may be possible.
What Security Teams Should Watch For
Organizations can improve detection by monitoring for unusual behavior, including:
- A OneDrive Update scheduled task executing every minute.
- RabbitMQ or Redis network traffic originating from employee workstations instead of servers.
- Unexpected execution of Windows commands such as takeown and icacls targeting critical boot files like bootmgr or ntoskrnl.exe outside approved maintenance periods.
Microsoft also recommends:
- Enabling Tamper Protection to prevent attackers from disabling antivirus software.
- Activating cloud-delivered protection and automatic remediation.
- Running Endpoint Detection and Response (EDR) in block mode.
- Blocking the known command-and-control servers associated with the malware.
Final Thoughts
GigaWiper demonstrates how modern malware is evolving from single-purpose tools into flexible attack platforms.
With capabilities ranging from surveillance and remote control to irreversible system destruction, attackers can decide how to use the malware after gaining access to a network. This makes proactive monitoring, rapid incident detection, and secure offline backups more important than ever.
As investigations continue, researchers expect additional components and capabilities of GigaWiper to emerge, highlighting the need for organizations to remain vigilant against increasingly sophisticated cyber threats.
