MalwareRansomwareUsed by 1 actor

GigaWiper

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

CyberAv3ngers

Microsoft has taken apart a destructive Windows backdoor it calls GigaWiper. What stands out is how it is built: not one tool but three older destructive programs bolted into one, offered as commands the operator can choose from.

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

22 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1053.005Scheduled TaskEvidence2

It creates a scheduled task named OneDrive Update that runs every minute and tracks itself in a registry key under HKCU\SOFTWARE\OneDrive\Environment.

T1059.001PowerShellEvidence1

Type: shell command – Command for running PowerShell commands.

Persistence

2 techniques

T1053.005Scheduled TaskEvidence2

It creates a scheduled task named OneDrive Update that runs every minute and tracks itself in a registry key under HKCU\SOFTWARE\OneDrive\Environment.

T1112Modify RegistryEvidence2

It creates a scheduled task named OneDrive Update that runs every minute and tracks itself in a registry key under HKCU\SOFTWARE\OneDrive\Environment.

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence2

It creates a scheduled task named OneDrive Update that runs every minute and tracks itself in a registry key under HKCU\SOFTWARE\OneDrive\Environment.

Stealth

3 techniques

T1036MasqueradingEvidence1

To stay out of sight, GigaWiper pretends to be OneDrive.

T1070.001Clear Windows Event LogsEvidence1

Command 19: Clears Windows event logs... it deletes the System, Setup, Application, and ForwardedEvents event logs

T1070.004File DeletionEvidence2

can wipe Windows event logs to cover its tracks

Defense Impairment

1 technique

T1112Modify RegistryEvidence2

It creates a scheduled task named OneDrive Update that runs every minute and tracks itself in a registry key under HKCU\SOFTWARE\OneDrive\Environment.

Credential Access

1 technique

T1056.001KeyloggingEvidence2

Microsoft found more commands sitting dormant in the samples it examined, including stubs for a keylogger and additional wipers.

Discovery

3 techniques

T1007System Service DiscoveryEvidence1

It also collects system details, manages running programs and services...

T1057Process DiscoveryEvidence2

It also collects system details, manages running programs and services...

T1082System Information DiscoveryEvidence2

It also collects system details, manages running programs and services, edits the registry, and can wipe Windows event logs to cover its tracks.

Collection

3 techniques

T1056.001KeyloggingEvidence2

Microsoft found more commands sitting dormant in the samples it examined, including stubs for a keylogger and additional wipers.

T1113Screen CaptureEvidence2

It takes screenshots of every monitor, records the screen while someone is working...

T1125Video CaptureEvidence1

Command 10: Records the screen when the user is not idle (10s) and the system is unlocked

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence2

For its command traffic, it skips ordinary web requests and rides on real business services instead: RabbitMQ for tasking, Redis for results...

T1105Ingress Tool TransferEvidence1

Command 4: Uses MinIO Client (mc) to upload a file to a remote storage

T1219Remote Access ToolsEvidence2

It takes screenshots of every monitor, records the screen while someone is working, and can open a hidden VNC session that streams the display and lets the attacker type and move the mouse.

Exfiltration

1 technique

T1567.002Exfiltration to Cloud StorageEvidence1

For its command traffic, it skips ordinary web requests and rides on real business services instead: RabbitMQ for tasking, Redis for results, and MinIO for exfiltration.

Impact

5 techniques

T1486Data Encrypted for ImpactEvidence2

Fake ransomware built on older code called Crucio. It encrypts files, adds a .candy extension, and changes the desktop wallpaper to an alarming warning image. There is no ransom note and no saved key, so there is nothing to pay and nothing to decrypt.

T1489Service StopEvidence1

Command 17: Service manager... service_operation create delete restart query start list stop

T1529System Shutdown/RebootEvidence1

After it finishes wiping the drives, the malware forces an immediate reboot by invoking Windows shutdown functionality with restart and zero-delay options.

T1561Disk WipeEvidence2

A raw disk wiper that overwrites the physical drive and wipes the partition table (the map of how the disk is laid out) before rebooting.

T1561.001Disk Content WipeEvidence2

A raw disk wiper that overwrites the physical drive and wipes the partition table (the map of how the disk is laid out) before rebooting.

Other

1 technique

T1562Impair DefensesEvidence2

Microsoft recommends turning on tamper protection so attackers cannot switch off your antivirus

INDICATORS OF COMPROMISE

IOCs tracked for this family

8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in apptoday

hash.sha256●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

the hacker newsNews

Jul 9, 2026

New GigaWiper Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware

A Go-based Windows backdoor with destructive and surveillance capabilities. It can wipe raw disks, overwrite the Windows drive, run fake ransomware that encrypts files without saving the key, take screenshots, record screens, open hidden VNC sessions, manage services and registry settings, and clear event logs. It masquerades as OneDrive for persistence and uses RabbitMQ, Redis, and MinIO for command, result handling, and exfiltration.

microsoft generalNews

Jul 9, 2026

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware | Microsoft Security Blog

A Golang-based modular backdoor with RabbitMQ/Redis C2, persistence, remote administration, screen capture/recording, registry/process/service management, and multiple destructive payloads including physical disk wiping, secure multi-pass wiping, BSOD/boot sabotage, and fake ransomware-style irreversible file encryption.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching8

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping22

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareRansomwareUsed by 1 actor

GigaWiper

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

CyberAv3ngers

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

22 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1053.005Scheduled TaskEvidence2

It creates a scheduled task named OneDrive Update that runs every minute and tracks itself in a registry key under HKCU\SOFTWARE\OneDrive\Environment.

T1059.001PowerShellEvidence1

Type: shell command – Command for running PowerShell commands.

Persistence

2 techniques

T1053.005Scheduled TaskEvidence2

It creates a scheduled task named OneDrive Update that runs every minute and tracks itself in a registry key under HKCU\SOFTWARE\OneDrive\Environment.

T1112Modify RegistryEvidence2

It creates a scheduled task named OneDrive Update that runs every minute and tracks itself in a registry key under HKCU\SOFTWARE\OneDrive\Environment.

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence2

It creates a scheduled task named OneDrive Update that runs every minute and tracks itself in a registry key under HKCU\SOFTWARE\OneDrive\Environment.

Stealth

3 techniques

T1036MasqueradingEvidence1

To stay out of sight, GigaWiper pretends to be OneDrive.

T1070.001Clear Windows Event LogsEvidence1

Command 19: Clears Windows event logs... it deletes the System, Setup, Application, and ForwardedEvents event logs

T1070.004File DeletionEvidence2

can wipe Windows event logs to cover its tracks

Defense Impairment

1 technique

T1112Modify RegistryEvidence2

It creates a scheduled task named OneDrive Update that runs every minute and tracks itself in a registry key under HKCU\SOFTWARE\OneDrive\Environment.

Credential Access

1 technique

T1056.001KeyloggingEvidence2

Microsoft found more commands sitting dormant in the samples it examined, including stubs for a keylogger and additional wipers.

Discovery

3 techniques

T1007System Service DiscoveryEvidence1

It also collects system details, manages running programs and services...

T1057Process DiscoveryEvidence2

It also collects system details, manages running programs and services...

T1082System Information DiscoveryEvidence2

It also collects system details, manages running programs and services, edits the registry, and can wipe Windows event logs to cover its tracks.

Collection

3 techniques

T1056.001KeyloggingEvidence2

Microsoft found more commands sitting dormant in the samples it examined, including stubs for a keylogger and additional wipers.

T1113Screen CaptureEvidence2

It takes screenshots of every monitor, records the screen while someone is working...

T1125Video CaptureEvidence1

Command 10: Records the screen when the user is not idle (10s) and the system is unlocked

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence2

For its command traffic, it skips ordinary web requests and rides on real business services instead: RabbitMQ for tasking, Redis for results...

T1105Ingress Tool TransferEvidence1

Command 4: Uses MinIO Client (mc) to upload a file to a remote storage

T1219Remote Access ToolsEvidence2

It takes screenshots of every monitor, records the screen while someone is working, and can open a hidden VNC session that streams the display and lets the attacker type and move the mouse.

Exfiltration

1 technique

T1567.002Exfiltration to Cloud StorageEvidence1

For its command traffic, it skips ordinary web requests and rides on real business services instead: RabbitMQ for tasking, Redis for results, and MinIO for exfiltration.

Impact

5 techniques

T1486Data Encrypted for ImpactEvidence2

T1489Service StopEvidence1

Command 17: Service manager... service_operation create delete restart query start list stop

T1529System Shutdown/RebootEvidence1

After it finishes wiping the drives, the malware forces an immediate reboot by invoking Windows shutdown functionality with restart and zero-delay options.

T1561Disk WipeEvidence2

A raw disk wiper that overwrites the physical drive and wipes the partition table (the map of how the disk is laid out) before rebooting.

T1561.001Disk Content WipeEvidence2

A raw disk wiper that overwrites the physical drive and wipes the partition table (the map of how the disk is laid out) before rebooting.

Other

1 technique

T1562Impair DefensesEvidence2

Microsoft recommends turning on tamper protection so attackers cannot switch off your antivirus

INDICATORS OF COMPROMISE

IOCs tracked for this family

8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in apptoday

hash.sha256●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

the hacker newsNews

Jul 9, 2026

New GigaWiper Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware

microsoft generalNews

Jul 9, 2026

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware | Microsoft Security Blog

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching8

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping22

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.