GigaWiper and the Anatomy of a Multi-Source Destructive Backdoor

Summary

GigaWiper is a sophisticated Golang-based backdoor that brings together several destructive functions within a single implant. It combines command-and-control capabilities with options for disk wiping, fake ransomware behavior, and broader system disruption. By merging code from different malware families, the tool gives attackers flexibility to choose how and when to trigger destructive actions.

Investigation

Microsoft Threat Intelligence identified GigaWiper in October 2025 through code-level examination of unstripped PE files. The investigation showed that the malware includes components derived from Crucio ransomware and FlockWiper. Researchers also identified its command structures, persistence through scheduled tasks, and command-and-control communications that rely on RabbitMQ and Redis.

Mitigation

Organizations should enable tenant-wide tamper protection and enforce always-on Microsoft Defender Antivirus protection through Group Policy. It is also recommended to deploy EDR in block mode and use attack surface reduction rules to prevent unauthorized executables from running. In addition, blocking direct connectivity to known malicious command-and-control infrastructure is essential.

Response

If GigaWiper activity is detected, security teams should isolate affected endpoints immediately to stop destructive commands from being executed. EDR investigation and remediation capabilities should be used in fully automated mode to remove malicious artifacts as quickly as possible. Windows event logs and registry changes should also be reviewed for evidence of persistence or unauthorized administrative actions.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has successfully gained administrative access to the target workstation. To prevent forensic analysis and disrupt operations, they deploy the GigaWiper payload. The goal is to execute a destructive wiping routine. To mimic the known GigaWiper behavior, the attacker executes the binary using specific command-line arguments that trigger the malware’s internal functions for disk discovery and destruction. This specific execution pattern is what our detection rule targets.

• Regression Test Script:

  # Simulation Script for GigaWiper Detection Validation
  # This script simulates the execution of GigaWiper.exe with the specific 
  # command line arguments required to trigger the detection rule.
  
  $SimulatedBinary = "$env:TEMPGigaWiper.exe"
  
  # Create a dummy file to represent the malware binary
  New-Item -Path $SimulatedBinary -ItemType File -Force | Out-Null
  
  Write-Host "[+] Created dummy binary: $SimulatedBinary" -ForegroundColor Cyan
  
  # Execute the dummy binary with the specific strings the rule looks for
  # We use 'cmd /c' to ensure the command line is captured clearly in logs
  Write-Host "[+] Executing simulated GigaWiper command..." -ForegroundColor Yellow
  Start-Process "cmd.exe" -ArgumentList "/c `"$SimulatedBinary`" --args main.FindWindowsDrive --mode main.unallocateDrive --data main.writeRandToDrive" -Wait
  
  Write-Host "[+] Simulation command executed. Check your SIEM/EDR for alerts." -ForegroundColor Green

• Cleanup Commands:

  # Cleanup script to remove the simulated malware binary
  $SimulatedBinary = "$env:TEMPGigaWiper.exe"
  if (Test-Path $SimulatedBinary) {
      Remove-Item -Path $SimulatedBinary -Force
      Write-Host "[+] Successfully removed $SimulatedBinary" -ForegroundColor Green
  } else {
      Write-Host "[!] File not found, nothing to clean." -ForegroundColor Red
  }