Destructive - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/destructive/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 09 Jul 2026 15:51:46 +0000GigaWiper: Multi-Payload Destructive Backdoorhttps://feed.craftedsignal.io/briefs/2026-07-gigawiper/Thu, 09 Jul 2026 15:51:46 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-gigawiper/GigaWiper is a sophisticated, Golang-based destructive backdoor observed since October 2025 by Microsoft Threat Intelligence, that combines robust command-and-control (C2) capabilities with multiple destructive payloads, including physical disk wiping, ransomware-like encryption derived from Crucio, and multi-pass secure wiping reimplemented from FlockWiper.Since October 2025, Microsoft Threat Intelligence has been tracking GigaWiper, a highly destructive Golang-based backdoor that consolidates multiple wiper and ransomware-like capabilities. This implant stands out for its modular design, merging code from previously distinct malware families such as a standalone physical disk wiper, a destructive component derived from Crucio ransomware that encrypts files with unrecoverable keys, and a multi-pass secure wiping logic reimagined from FlockWiper. GigaWiper establishes persistence via a scheduled task and a registry key, communicating with its command-and-control (C2) infrastructure over RabbitMQ and Redis. This consolidation into a single platform reflects an operational efficiency trend among threat actors, aiming to reduce deployment footprints while expanding destructive potential across targeted environments.

Attack Chain

  1. Initial execution of the GigaWiper backdoor implant on a compromised system.
  2. The implant checks for prior execution via the HKCU\SOFTWARE\OneDrive\Environment registry key and creates a scheduled task named "OneDrive Update" for persistence, running every minute and at system startup.
  3. GigaWiper establishes command-and-control (C2) communication channels, utilizing RabbitMQ and Redis.
  4. Upon receiving a destructive command from the C2, GigaWiper enumerates physical disk drives using Windows Management Instrumentation (WMI) queries to identify targets.
  5. It proceeds to target non-Windows drives, removing their partition references via DeviceIoControl with IOCTL_DISK_CREATE_DISK to reinitialize partitioning metadata.
  6. The malware then overwrites the raw content of the identified drives in 0xA00000-sized chunks, filling the first byte with randomized data and the rest with zeros, effectively destroying data.
  7. In some variants, GigaWiper encrypts files using a mechanism derived from Crucio ransomware, where encryption keys are not saved, rendering data unrecoverable.
  8. Finally, it forces an immediate system reboot by invoking Windows shutdown functionality with restart and zero-delay options to finalize the destructive impact.

Impact

GigaWiper's primary impact is severe data destruction and system unavailability. Observed since October 2025, it has been used to wipe compromised environments, rendering systems inoperable and data irrecoverable. The consolidation of multiple wiping and ransomware capabilities means that organizations face a multi-pronged attack that not only deletes files and partitions but also encrypts data without any recovery possibility. This leads to significant operational disruption, data loss, and substantial recovery costs across targeted organizations. While specific victim counts or sectors are not detailed, the nature of the threat indicates potential for widespread damage across any Windows-based enterprise environment.

Recommendation

  • Deploy the provided Sigma rules to your SIEM/EDR and tune them for your environment.
  • Enable Sysmon process-creation logging to capture schtasks.exe and shutdown.exe activity to activate the rules above.
  • Monitor for modifications to the HKCU\SOFTWARE\OneDrive\Environment registry key by unfamiliar processes, leveraging registry_set logs.
  • Implement strong egress filtering to detect and block suspicious outbound connections, particularly those to unknown RabbitMQ or Redis endpoints.
]]>criticaladvisorywiperdestructivebackdoorransomwaregolangwindows