GigaWiper: The Multi-Tool Windows Backdoor That Spies and Destroys
In the ever-evolving world of cybersecurity, a new threat has emerged, and it’s a doozy. Microsoft recently dissected a destructive Windows backdoor they’ve dubbed GigaWiper, and it’s not your average piece of malware. This thing is a Frankenstein’s monster of cyber threats, combining three older destructive tools into one versatile platform.
What Makes GigaWiper Unique?
GigaWiper isn’t just one tool—it’s a Swiss Army knife of malware. It offers attackers a choice of commands to wreak havoc in multiple ways:
- Wipe the entire disk: This command overwrites the physical drive and erases the partition table, leaving nothing to recover. It’s like reformatting your hard drive, but with malicious intent.
- Fake ransomware: This one pretends to be ransomware by encrypting files and adding a
.candyextension. But here’s the kicker: there’s no ransom note and no decryption key. It’s destruction disguised as ransomware. - Overwrite the Windows drive: This command overwrites the Windows drive multiple times with different data patterns, rendering it unusable.
What’s scary about GigaWiper is that it’s not about extortion—it’s about total destruction. There’s no way to recover the encrypted files or wiped drives. The goal is to leave the machine completely dead.
But Wait, There’s More: Spying Capabilities
GigaWiper isn’t just about destruction; it’s also a sophisticated spy. It can:
- Take screenshots of every monitor.
- Record the screen while someone is working.
- Open a hidden VNC session to control the machine remotely.
- Collect system details, manage programs and services, and edit the registry.
- Wipe Windows event logs to cover its tracks.
To stay hidden, GigaWiper disguises itself as OneDrive, creating a scheduled task called OneDrive Update that runs every minute. It also hides its command traffic by piggybacking on legitimate business services like RabbitMQ, Redis, and MinIO, making it harder to detect.
Who’s Behind GigaWiper?
Microsoft hasn’t named any specific country, but Binary Defense (which identified the same malware under the name BLUERABBIT) ties it to an Iran-linked group targeting Israeli organizations. The fake-ransomware code in GigaWiper traces back to Crucio, which was flagged in a 2023 CISA advisory as suspected ransomware linked to Iran’s Islamic Revolutionary Guard Corps.
This isn’t the first time Iran-linked groups have used wipers. In 2023, the same crew reportedly broke into water and energy sites across the US, Israel, the UK, and Ireland, logging into industrial controllers and even taking control of a water booster station in Pennsylvania.
How to Protect Yourself
Since GigaWiper is malware and not a software flaw, there’s no patch to fix it. The key to defense is early detection and clean, offline backups. Here are some specific signs to watch for:
- A OneDrive Update scheduled task running every minute.
- RabbitMQ or Redis traffic from desktops (not servers).
- Processes using
takeownandicaclsto take ownership of Windows boot files outside maintenance windows.
Microsoft also recommends enabling tamper protection for your antivirus, blocking the known command servers, and running endpoint detection in block mode.
The Bigger Picture
GigaWiper is part of a growing trend of sophisticated, multi-purpose malware. Attackers are combining tools into flexible platforms, making it harder for defenders to predict their intentions. One tool can now spy, steal, or destroy, depending on the attacker’s goals.
This isn’t the first time we’ve seen this tactic. NotPetya, the infamous 2017 malware, also posed as ransomware while destroying data. The disguise buys attackers time, as victims initially think they’re dealing with recoverable ransomware, not total destruction.
Final Thoughts
GigaWiper is a wake-up call for organizations to beef up their cybersecurity defenses. With threats like this on the rise, early detection and robust backups are no longer optional—they’re essential. Stay vigilant, and stay safe out there!