Microsoft Warns of GigaWiper Backdoor Built to Destroy Windows PCs
Microsoft details GigaWiper, a destructive Windows backdoor that can wipe disks, encrypt files and give attackers
Microsoft has identified GigaWiper, a destructive Windows backdoor that combines code from older malware families to offer remote access and system destruction capabilities. First seen in October 2025, GigaWiper can wipe disks, encrypt files with the .candy extension (without recovery options), and maintain persistence through a disguised scheduled task. It also supports extensive command codes for system management, data exfiltration, and remote control.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonGigaWiper represents a dangerous hybrid threat that merges persistent remote access with destructive capabilities, including disk wiping and encryption without any recovery path. The malware disguises itself as a legitimate scheduled task, allowing it to survive reboots and evade casual inspection. What makes this particularly severe is the intentional removal of recovery options — once triggered, data loss is designed to be permanent. Organizations without robust offline backups and behavioral monitoring are especially vulnerable to this kind of destructive payload. This matters because destructive malware can cripple business operations far longer than ransomware, as there is no negotiation path — only restoration from backups.
What helps against this
How we list vendors
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — GigaWiper
- malware — Crucio ransomware
- malware — FlockWiper