Security & Threat Intelligence · 22.07.2026, 16:21 UTC
GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware
| Schweregrad | info |
|---|---|
| Kategorie | Security & Threat Intelligence |
| Quelle | Microsoft Security Blog ↗ |
| Veröffentlicht | 22.07.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
In this article
A wiper inside a backdoorBackdoor capabilitiesHow GigaWiper was assembledConclusion: Multiple destructive capabilities consolidated into a single implantDefending against destructive threatsMicrosoft Defender detectionsIndicators of compromise
In October 2025, Microsoft Threat Intelligence identified destructive wiping activity and uncovered a sophisticated Go programming language (Golang)-based backdoor we now track as GigaWiper, a versatile implant that combines robust command-and-control (C2) capabilities with multiple destructive payloads, including disk wiping, fake ransomware, and system-level sabotage.
GigaWiper is particularly notable for its makeup. It’s not a single, purpose-built tool, but an amalgamation of separate malware families that were folded into GigaWiper as on-demand backdoor commands, giving threat actors the flexibility to choose their mode of destruction:
A standalone wiper that operates at the physical disk level, overwriting raw disk content and removing partition metadata.
A destructive command that derives from Crucio ransomware and encrypts files with randomly generated keys that are never saved, making decryption impossible.
A wiping command that reimplements the logic of FlockWiper, a C-based malware reimplemented in Golang with additional multi-pass secure wiping.
The consolidation of multiple destructive capabilities into a modular backdoor reflects a notable shift in wiper malware, which are typically designed purely to destroy rather than to extort and carry real-world consequences. GigaWiper …