GigaWiper Combines Multiple Malware for System-Level Sabotage
GigaWiper malware combines wiper, ransomware, and backdoor for system sabotage.
GigaWiper is a sophisticated Go-based backdoor observed since October 2025, capable of system-level sabotage. It integrates a standalone wiper, ransomware-like encryption, and multi-pass wiping commands. This modular approach allows for both espionage and destructive operations, reflecting a shift in wiper malware design.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonGigaWiper represents a dangerous evolution in destructive malware, merging espionage-grade backdoor access with ransomware-style encryption and multi-pass data wiping into a single modular toolkit. This combination allows threat actors to first exfiltrate sensitive data before rendering systems completely inoperable, maximizing both intelligence value and destructive impact. The modular design makes detection harder, as each component can operate independently or in concert depending on mission objectives. Organizations without robust offline backups and rapid incident response playbooks face potentially unrecoverable losses when such malware executes. The shift toward hybrid wiper-ransomware-backdoor tooling signals that defenders must now prepare for attacks designed to simultaneously steal, encrypt, and destroy.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.