GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware
Microsoft identifies GigaWiper, a sophisticated Golang backdoor combining disk wiping, ransomware, and destructive
Microsoft Threat Intelligence uncovered GigaWiper in October 2025, a modular Golang-based backdoor that consolidates multiple destructive malware families into a single platform. The malware combines disk wiping capabilities, fake ransomware encryption derived from Crucio, and FlockWiper-based secure wiping logic into flexible on-demand commands. GigaWiper represents a shift in wiper malware toward operational efficiency, merging standalone tools to reduce deployment footprint while expanding destructive capabilities.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonGigaWiper represents a significant evolution in destructive malware, consolidating disk wiping, fake ransomware, and secure file deletion into a single modular Golang-based backdoor. By merging multiple standalone malware families, threat actors reduce their deployment footprint while dramatically expanding their destructive reach — making detection harder and impact greater. The use of fake ransomware components is particularly dangerous as it can delay incident response by misleading defenders into treating a destructive attack as a recoverable ransomware event. Organizations without tested backup and recovery plans and robust endpoint detection will face irreversible data loss when such malware executes on-demand destructive commands. This threat underscores the need for layered defenses that assume compromise and prioritize rapid detection and isolation.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — GigaWiper
- malware — Crucio
- malware — FlockWiper