GigaWiper backdoor merges wipers, enables disk sabotage
Microsoft reports GigaWiper, a Go-based backdoor first seen in October 2025, combines multiple malware families and wipers to erase disks, trigger BSODs, encrypt files and run remote commands.
Microsoft reports a Go-based backdoor called GigaWiper that folds several malware families and destructive wipers into a single implant. The tool was first observed in October 2025 and has been active for more than eight months on Windows systems.
Microsoft’s analysis describes GigaWiper as modular software. The implant can run a standalone disk wiper, perform a multi-pass wipe, or execute a ransomware-like file encryption routine. The wiping component operates at the physical disk level and identical wiping code is embedded in the backdoor itself.
The wiper locates the Windows partition by querying Windows Management Instrumentation, removes partition references from non-Windows drives, wipes each targeted drive and then forces a system reboot. Microsoft found the same code flow and function names in both the standalone wiper and the backdoor module.
For persistence and command-and-control, the backdoor uses RabbitMQ and Redis. Operators can instruct the implant to start a server that provides remote control of an infected machine.
Commands observed include executing the disk wiper, triggering a Blue Screen of Death, uploading files via the MinIO client, running executables, executing PowerShell commands, taking screenshots, recording the screen and collecting system information. The implant also includes a command specifically to wipe the Windows installation.
GigaWiper supports two file-encrypting commands. One is destructive by design because it uses random encryption keys that are never saved. The other supports bulk encryption and decryption of files. The backdoor also contains components to manage processes, the registry, RabbitMQ routes and services, and to clear Windows event logs.
Microsoft linked the encryption code to the developer of the Crucio ransomware and identified a shared wiping function with FlockWiper, a wiper first seen in June 2025 that appears to have been ported to Go for inclusion in GigaWiper.
Microsoft wrote: “The consolidation of multiple destructive capabilities into a modular backdoor reflects a notable shift in wiper malware.” The company added that the implant lets operators maintain access for espionage and trigger destructive operations on demand.
Articles by this author
