Loading malware…
GigaWiper, also tracked as BlueRabbit, is a modular Windows backdoor written in Go that combines remote administration, surveillance, data exfiltration, and operator-triggered destruction. First observed in compromised environments in October 2025, it is deployed after attackers have obtained access. Observed forms include a standalone physical-disk wiper and a larger backdoor incorporating the same wiping functionality alongside approximately 20 command functions.
The backdoor supports PowerShell execution, process and service management, registry modification, system reconnaissance, screenshots, continuous screen recording, and VNC-like remote desktop control with keyboard and mouse input. It collects hardware, operating-system, network, firmware, user, and antivirus information. Persistence is established through a scheduled task masquerading as a OneDrive updater that runs at startup and every minute. GigaWiper receives commands through RabbitMQ over AMQP, returns command status and output through Redis, and uses MinIO Client to upload stolen files. It can clear Windows event logs and modify firewall rules to permit remote access.
Its destructive capabilities include overwriting physical disks and partition metadata, repeatedly overwriting the Windows installation drive, and disabling recovery and deleting critical system components to prevent booting. A Crucio-derived component imitates ransomware by encrypting files with randomly generated keys that are deliberately discarded, providing no decryption-based recovery path or ransom note. Its multi-pass wiping functionality reimplements FlockWiper logic in Go. This combination allows operators to maintain access and conduct surveillance before initiating irreversible data destruction. Microsoft has not publicly attributed GigaWiper to a specific threat actor.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Microsoft has taken apart a destructive Windows backdoor it calls GigaWiper. What stands out is how it is built: not one tool but three older destructive programs bolted into one, offered as commands the operator can choose from.
37 distinct techniques documented for this family, organized by ATT&CK tactic.
The GigaWiper backdoor is a post-access tool. In other words, attackers run it after they already hold a foothold.
It enumerates drives using Windows Management Instrumentation (WMI) to identify the Windows partition...
Once installed, the malware establishes persistence by creating a scheduled task disguised as “OneDrive Update”. The task is executed when the system starts and subsequently runs once every minute.
The malware establishes persistence by creating a scheduled task named OneDrive Update, while maintaining execution state through the registry key HKCU\SOFTWARE\OneDrive\Environment.
"the backdoor supports roughly 20 commands covering activities such as remote shell execution..."
These commands allow its operators to execute PowerShell instructions...
Microsoft describes ... a shell command mode
Once installed, the malware establishes persistence by creating a scheduled task disguised as “OneDrive Update”. The task is executed when the system starts and subsequently runs once every minute.
The malware establishes persistence by creating a scheduled task named OneDrive Update, while maintaining execution state through the registry key HKCU\SOFTWARE\OneDrive\Environment.
The GigaWiper backdoor is a post-access tool. In other words, attackers run it after they already hold a foothold.
The malware is also capable of modifying the Windows Registry...
Its management utilities include process, service, and registry managers that can create, list, or kill processes, manage Windows services
Once installed, the malware establishes persistence by creating a scheduled task disguised as “OneDrive Update”. The task is executed when the system starts and subsequently runs once every minute.
The malware establishes persistence by creating a scheduled task named OneDrive Update, while maintaining execution state through the registry key HKCU\SOFTWARE\OneDrive\Environment.
The GigaWiper backdoor is a post-access tool. In other words, attackers run it after they already hold a foothold.
Its management utilities include process, service, and registry managers that can create, list, or kill processes, manage Windows services
It disguises persistence as a OneDrive updater task... Because these names mimic Microsoft software, the activity blends into normal system noise.
The backdoor supports 20 numbered commands. These cover screenshots, screen recording, process control, log wiping, and system profiling.
Command 2 triggers a Blue Screen of Death and prevents the machine from starting again by deleting critical boot and kernel files.
The GigaWiper backdoor is a post-access tool. In other words, attackers run it after they already hold a foothold.
The malware is also capable of modifying the Windows Registry...
Monitor for connections to the known C2 servers, the creation of the “OneDrive Update” scheduled task, and unauthorized attempts to disable Windows recovery.
The malware is also capable of ... clearing Windows event logs...
To establish this connection, the malware modifies Windows Firewall rules to permit remote access.
в изученных образцах специалисты обнаружили пока незадействованные заготовки для кейлоггера
These commands allow its operators to execute PowerShell instructions, collect information about the computer and installed antivirus solutions and manage running processes and Windows services.
Microsoft describes ... registry management
These commands allow its operators to execute PowerShell instructions, collect information about the computer and installed antivirus solutions and manage running processes...
These commands allow its operators to execute PowerShell instructions, collect information about the computer and installed antivirus solutions...
"the backdoor supports roughly 20 commands covering activities such as remote shell execution, file management..."
"the backdoor supports roughly 20 commands covering activities such as remote shell execution, file management, process control, system reconnaissance, screenshot capture, and hidden remote desktop sessions."
открывать скрытую VNC-сессию, позволяя атакующим управлять клавиатурой и мышью жертвы
в изученных образцах специалисты обнаружили пока незадействованные заготовки для кейлоггера
The malware is also capable of ... capturing screenshots, recording activity displayed on connected monitors...
including "always run" for tasks such as continuous screen recording
“GigaWiper” receives commands from its operators through RabbitMQ servers and transmits the results of executed operations via Redis infrastructure.
GigaWiper allows threat actors to maintain control over infected systems, execute commands, deploy additional tooling
In addition, a remote-access capability similar to VNC allows operators to monitor the screen of an infected computer and control the system using keyboard and mouse input.
MinIO Client загружает похищенные файлы в удаленное хранилище
the malware generates random AES encryption keys and initialization vectors that are intentionally discarded after encryption. Unlike conventional ransomware operations, no mechanism exists for recovering encrypted files because the encryption material is never retained.
a destructive command that derives from Crucio ransomware and encrypts files with randomly generated keys that are never saved, making decryption impossible
управлять процессами и службами
allowing cyber threat actors to conduct both quiet espionage activity and destructive wiping operations... ultimately trigger one of multiple destructive commands on demand
including disk wiping, fake ransomware, and system sabotage
observed compromised environments being wiped with destructive tooling
A standalone wiper that operates at the physical disk level, overwriting raw disk content and removing partition metadata
Another function specifically targets the drive on which the Windows operating system is installed and irreversibly erases its contents.
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.