The Bottom Line: GigaWiper combines three known malware families (Crucio, FlockWiper) in a modular backdoor with 20 commands to delete or encrypt data after reconnaissance objectives are achieved.
Microsoft Threat Intelligence has analyzed the Go-based malware GigaWiper, observed in attacks since October 2025, which combines remote access with multiple disk-wiping and ransomware routines.
GigaWiper is classified as a hybrid between espionage malware and wiper. The operators assembled the malware from components of several existing malware families and embedded them as modular commands into a single backdoor. This differs from classic wiper malware design, which is exclusively conceived for destruction.
The Go-based malware supports 20 commands, including PowerShell execution, Windows service and process management, registry manipulation, screenshots and screen recording, event log deletion, and VNC-like remote control. Persistence is established through a disguised scheduled task as “OneDrive Update.” The command and control architecture uses RabbitMQ for commands and Redis for output delivery, enabling discrete network communication.
Microsoft has linked GigaWiper to at least two known malware families: Crucio, from which the file encryption logic (command 3) is derived, and FlockWiper, whose multi-pass wiping function was reimplemented in Go (command 12). Another command performs raw physical disk deletion, overwriting drives and removing partition metadata. The Crucio integration uses randomly generated keys that are never stored, making recovery impossible.
For defense, Microsoft recommends enabling EDR solutions and behavioral detection, endpoint hardening, use of attack surface reduction controls, and maintenance of offline backups or otherwise resilient backups. Microsoft has published Indicators of Compromise (IOCs) including file hashes and C2 IP addresses.
Source: www.csoonline.com · Published 10 July 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.