Thought Leadership
Microsoft has issued a warning about GigaWiper, a Windows backdoor that combines advanced espionage capabilities with destructive data wiping while disguising its activity as a ransomware attack.
Microsoft and cybersecurity firm Binary Defense have analyzed a new malware family known as GigaWiper, which is also tracked as BLUERABBIT in other security reports. Written in the Go programming language, the Windows malware consolidates three distinct destructive capabilities into a single platform, allowing attackers to select the most suitable payload depending on their target.
The first capability overwrites the physical hard drive and completely erases the partition table, making file recovery virtually impossible. The second component is based on older malware called Crucio and functions as fake ransomware. It encrypts files using the .candy extension but deliberately does not generate or store a decryption key, ensuring victims cannot recover their data by paying a ransom. The third component repeatedly overwrites the Windows system drive using varying data patterns to maximize destruction.
Built-In Espionage and Network Evasion
Beyond its destructive capabilities, the backdoor includes a comprehensive set of espionage features. It can continuously capture screen activity, take screenshots, and establish a hidden VNC session that enables direct remote access. The malware also collects system information, modifies the Windows Registry, and deletes Windows Event Logs to conceal its presence and hinder forensic investigations.
To remain unnoticed inside corporate environments, the malware masquerades as a legitimate OneDrive service by creating a scheduled task called OneDrive Update that runs every minute. For communication with its command-and-control infrastructure, it relies on legitimate enterprise technologies, using RabbitMQ for task distribution, Redis for returning execution results, and MinIO for data exfiltration. As a result, malicious traffic can blend into normal network activity in organizations that already use these platforms.
Links to Known Threat Actors and Detection Guidance
According to Binary Defense, citing Google’s Threat Intelligence Group, GigaWiper is associated with an Iran-linked threat group primarily targeting Israeli organizations. Microsoft did not attribute the malware to any nation-state actor in its own analysis. Portions of the code share functional similarities with CyberAv3ngers, a group previously linked to attacks against industrial control systems in the energy and water sectors.
Because GigaWiper is a post-compromise backdoor that is deployed only after attackers have already gained access to a network, there is no software patch that addresses a single underlying vulnerability. Instead, organizations should monitor for behavioral indicators that may reveal an ongoing compromise, including:
- A scheduled task named OneDrive Update configured to run every minute.
- Unexpected RabbitMQ or Redis traffic originating from employee workstations instead of dedicated servers.
- Processes taking ownership of critical Windows boot files such as bootmgr or ntoskrnl.exe outside normal maintenance windows.
(ll)
