Microsoft just took apart a nasty Windows backdoor called GigaWiper. It’s not subtle.
What makes it interesting is the design. It’s not one piece of malware — it’s three older destructive programs bolted together into a single backdoor, each offered as a command the attacker can choose from. Pick your poison.
Option one: a raw disk wiper that overwrites the physical drive and destroys the partition table. No file-by-file recovery. The whole disk, gone.
Option two: fake ransomware built on older code called Crucio. It encrypts your files, slaps a .candy extension on them, and changes your wallpaper to something scary. But there’s no ransom note. No saved decryption key. It’s destruction dressed up as ransomware — nothing to pay, nothing to decrypt.
Option three: overwrite the Windows drive multiple times with different data patterns. Microsoft says it’s a Go rewrite of a wiper they track as FlockWiper.
But GigaWiper spies too. It takes screenshots, records the screen, and can open a hidden VNC session. It collects system info, manages processes, edits the registry, and wipes Windows event logs to cover tracks. Microsoft found dormant code stubs for a keylogger and more wipers.
To stay hidden, GigaWiper pretends to be OneDrive. It creates a scheduled task called “OneDrive Update” that runs every minute. Its command traffic rides on RabbitMQ, Redis, and MinIO — legitimate tools that look normal on business networks.
The same malware was also spotted by Binary Defense under the name BLUERABBIT. Binary Defense ties it to an Iran-nexus group targeting Israeli organizations. Microsoft doesn’t name a country. Either way, there’s no patch for this. GigaWiper runs after the attacker is already inside. The real defense: early detection and clean offline backups.
