GigaWiper: Inside the Destructive Windows Backdoor

GigaWiper is not conventional ransomware that starts negotiating after it encrypts files. It is a Go-based Windows backdoor that lets an operator retain control, observe a user, move data and then trigger one of several destructive mechanisms at a chosen time. Its most misleading option looks like extortion even though the encryption key is never saved and paying cannot recover the data.

Microsoft Threat Intelligence published its GigaWiper analysis on 9 July 2026. The team began observing destructive activity in October 2025. Google Threat Intelligence Group and Binary Defense track the same samples as BLUERABBIT. Microsoft did not attribute the campaign in this report to a named group or country, so code relationships should not be converted into confident geopolitical attribution.

GigaWiper at a glance

Property	Confirmed capability
platform	Windows PE files written in Golang
role	modular backdoor with destruction on demand
C2	RabbitMQ over AMQP for tasks and Redis for status and output
persistence	a OneDrive-themed registry key and OneDrive Update scheduled task
surveillance	screenshots, screen recording and VNC-like remote control
administration	PowerShell, process, service, Registry and host reconnaissance functions
destruction	raw disk overwrite, fake ransomware and multi-pass Windows-drive wiping
defence evasion	Windows event-log clearing and firewall rules impersonating a system component

This distinction matters operationally. GigaWiper has no CVE and there is no single patch that “fixes GigaWiper”. The implant arrives after an attacker gains code execution. Defence must cover the initial access path, credentials, endpoint, C2 traffic, administrative privilege, backups and recovery.

Why a “wiper inside a backdoor” changes the risk model

A traditional wiper often has one short and obvious mission: destroy data and stop. GigaWiper combines that function with a remote-access platform. Its operator can first discover the environment, inspect processes and services, run commands, observe screens, transfer files and reserve destruction for the final stage of an operation.

The first useful alert therefore may not involve mass disk writes. Earlier signals can look like any other backdoor: unusual persistence, an AMQP connection, a PowerShell child process, a new firewall rule, service manipulation or screen recording. An organisation that detects only thousands of files being encrypted may respond when rebuilding the host is already the sole viable option.

GigaWiper also shows why endpoint protection cannot end at antivirus. Behaviour must be correlated across layers, as explained in our practical comparison of SIEM, XDR and EDR, and tied to a rehearsed escalation path.

Three separate destruction paths

1. Raw overwrite of physical disks

The standalone wiper and command 1 in the backdoor enumerate drives through WMI, identify the physical device containing Windows and operate on disk devices directly. The code removes partition references from other drives, overwrites raw content in chunks and forces a restart. This is not ordinary file deletion that can be reversed from a recycle bin or fixed by restoring several folders.

2. Destruction disguised as ransomware

Command 3 derives from Crucio code. Files are encrypted with AES-CBC and receive the .candy extension, but the randomly generated key and initialisation vector are not saved. There is no genuine negotiation or recovery mechanism. Microsoft describes the function as a wiper disguised as ransomware.

This is an important cue for the crisis team: a ransomware-looking desktop does not prove that a decryptor exists. A payment decision must not rely on the wallpaper. Preserve the sample, identify the family, confirm the cryptographic behaviour and assess backups first. Preparation fundamentals are covered in how to defend against ransomware.

3. Multi-pass wiping of the system drive

Command 12, named WipeCMain, implements logic similar to FlockWiper, re-created from C in Go. It targets the Windows drive and performs successive overwrite passes with zeroes, 0xFF and random data. From a security-operations perspective, all three paths lead to the same conclusion: stop the command before execution, and make the contingency plan assume a rebuild from a trusted source.

The backdoor exposes twenty command codes

Microsoft mapped numeric codes from 1 to 20. Not all are implemented, but the confirmed set demonstrates extensive control:

• command 7 runs a PowerShell shell and retains the working directory between tasks;
• command 9 captures every active display;
• command 10 records the screen while the user is active and the session is unlocked;
• messages around command 11 suggest intended keylogger functionality, although Microsoft did not observe the relevant executable structure populated;
• commands 15–18 collect host data and manage processes, services and the Registry;
• command 19 clears System, Setup, Application and ForwardedEvents logs, then attempts to remove Security logs;
• command 20 provides VNC-like screen streaming plus mouse and keyboard control.

Analysts should preserve this distinction. A log string that suggests a keylogger is not equal to observing a working keylogger module. At the same time, that unconfirmed function does not reduce the severity of a compromise where the operator can record the screen, run commands and control the session.

Persistence and C2 communications

GigaWiper creates HKCU\SOFTWARE\OneDrive\Environment to track execution count. It then adds a scheduled task named OneDrive Update, configured to run at startup and approximately every minute. The names are designed to blend into Windows, but they are not proof that a legitimate OneDrive component created them.

Tasks arrive over RabbitMQ/AMQP, while Redis carries results and status. The implant uses a fanout exchange named All to broadcast tasks to multiple clients and a Topic exchange for targeted routing. This gives network defenders more durable hypotheses than a filename alone. Unexpected AMQP from user networks, Internet-facing Redis connections and unusual destination ports should have an owner and a documented business purpose.

Blocking a known IP is necessary after detection but insufficient. C2 infrastructure can change, and an implant may receive an updated configuration. A mature cyber threat intelligence lifecycle combines IOCs with endpoint behaviour, DNS, proxy, identity and timing context.

Microsoft-published indicators of compromise

The following values are for defensive hunting. IP addresses are deliberately defanged so they do not become active links.

Type	Value	Description
SHA-256	633d4cbd496b1094495da89a64f5e6c31a0f6d4d1488411db5b0cba1cfe42001	GigaWiper backdoor
SHA-256	ce9ad5f6c12019f4aae5b189bd8ddf5bb09e75b06a0a587b25a855c65948c913	GigaWiper backdoor
SHA-256	f622ed85ef31ad4ab973f4e74524866fe1bb44f0965ad2b2ad796cd657a05bfd	GigaWiper backdoor
SHA-256	9706a192e2c1a1faaf0a521daf31c2af60ff4590e3f47bbb4abc227f42af0683	GigaWiper backdoor
SHA-256	3c30deb6556a94cfb84ae51798f4aecfae8c7358e55fdb321c5f2376579631cd	standalone GigaWiper
SHA-256	440b5385d3838e3f6bc21220caa83b65cd5f3618daea676f271c3671650ce9a3	Crucio
SHA-256	12c39f052f030a77c0cd531df86ad3477f46d1287b8b98b625d1dcf89385d721	FlockWiper
SHA-256	db41e0da7ab3305be8d9720769c6950b4dc1c1984ef857d3310eb873a0fc7674	FlockWiper
IPv4	185.182.193[.]21	observed C2
IPv4	212.8.248[.]104	observed C2

Do not quarantine a host merely because a task contains the word OneDrive. Validate the executable path, author, action, signature, parent process and correlated telemetry. Likewise, absence of these hashes does not exclude a sample rebuilt by the operator.

Detection hypotheses for the SOC

A defensive team can turn the research into layered analytics:

1. a new OneDrive Update task running every minute, especially one pointing to unsigned code outside Microsoft directories;
2. creation or modification of the registry path by a process unrelated to legitimate OneDrive activity;
3. AMQP or Redis traffic from endpoints without an approved queue client;
4. wevtutil clearing multiple channels, attempted deletion of Security.evtx, or a sudden forwarding gap;
5. an unknown Go binary launching PowerShell, WMI, service management and firewall changes;
6. mass .candy creation, increased file entropy and deletion of originals;
7. writes to PHYSICALDRIVE, partition-metadata changes or attempts to disable Windows recovery;
8. screen recording under C:\ProgramData\output and an unexpected listener following a firewall change.

Analytics should correlate multiple signals instead of alerting on every use of WMI or PowerShell. Test against historical telemetry, measure false positives and retain full events. Our Sigma and SIEM detection engineering guide describes that production process.

What to do after an IOC match

“File removed” does not close this incident. GigaWiper is a backdoor, so a positive match implies possible earlier interactive access.

The first 30 minutes

• isolate the endpoint through EDR or network controls without powering it off automatically;
• block known C2 at DNS, proxy, firewall and egress layers;
• preserve memory, connections, processes, tasks, Registry state, firewall rules and external logs;
• hunt for related events across other devices;
• activate the incident path with the service owner and business-continuity team.

The first four hours

Determine the identity and process that launched the implant, the initial access route, the first known event and the data accessible from the host. Review credentials, administrator sessions, remote tools, software deployment and lateral movement. If GigaWiper arrived through a privileged management platform, isolating one laptop is inadequate.

Rotate credentials in a controlled order after preserving evidence and closing the entry path. The incident response plan helps define roles, while the current NIST SP 800-61 Rev. 3 provides the broader incident-response framework.

Reducing risk before an alert appears

Microsoft recommends tamper protection, direct blocking of known C2, cloud-delivered protection, EDR in block mode, and automated investigation and remediation. Microsoft environments can follow the official tamper protection documentation.

Add controls that do not depend on one vendor:

• restrict endpoint egress to required protocols and managed proxies;
• protect endpoint-management systems with phishing-resistant MFA, PAM and dedicated admin workstations;
• prevent local administrators from adding independent antivirus exclusions;
• send logs off-host so command 19 cannot erase the only evidence;
• segment workstations, servers, backups and management infrastructure;
• test restoration of a complete service, not only one file.

A backup that can survive a wiper

A backup reachable with the same administrative identity and mounted as an ordinary share may be deleted before the wiper runs. The design needs an isolated or offline copy, immutability, separate credentials, monitoring for deletion attempts, and tested RPO and RTO targets. Our 3-2-1 backup strategy explains the model, while the CISA #StopRansomware Guide adds resilience and response recommendations.

The recovery exercise should assume simultaneous loss of Active Directory, endpoint management, the package repository and part of the network. Measure from the rebuild decision to a verified service. One successful file restore six months ago does not prove that today’s images, keys and dependencies still work.

Incident closure criteria

The team should close the incident only when it can demonstrate:

• removal of persistence and all related implants;
• identification and closure of the initial access route;
• exposure-window analysis across endpoints, identity and network;
• controlled rotation of credentials and tokens available to the attacker;
• rebuilding suspect systems from a known, trusted source;
• continuous monitoring for both IOCs and behavioural detections;
• a successful recovery test for critical services;
• documented telemetry gaps and formal acceptance of residual uncertainty.

GigaWiper is a warning about the phase before destruction. An organisation succeeds not when it recognises the post-encryption wallpaper, but when it detects remote control, abnormal persistence and C2 before the operator selects a destructive command.

Want to know whether your monitoring and backups can withstand a GigaWiper scenario? Book a BreachRoad technical assessment to validate endpoint telemetry, egress, administrative privilege, segmentation, SOC playbooks and real recovery without executing destructive code.