[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwbJF3pIPnzeiah5UeEJhrtYNzjik4Xo6RP2rNgyYC4o":3},{"article":4,"iocs":48,"watch_terms":58,"solutions":59,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"0aa4b36c-39ed-46e6-bac4-d73d2bc53d8b","Microsoft Warns of GigaWiper Backdoor Built to Destroy Windows PCs","microsoft-warns-of-gigawiper-backdoor-built-to-destroy-windows-pcs-e09f9e","Microsoft details GigaWiper, a destructive Windows backdoor that can wipe disks, encrypt files and give attackers remote access to compromised systems globally.","Microsoft has identified GigaWiper, a destructive Windows backdoor that combines code from older malware families to offer remote access and system destruction capabilities. First seen in October 2025, GigaWiper can wipe disks, encrypt files with the .candy extension (without recovery options), and maintain persistence through a disguised scheduled task. It also supports extensive command codes for system management, data exfiltration, and remote control.","Microsoft details GigaWiper, a destructive Windows backdoor that can wipe disks, encrypt files and give attackers","https:\u002F\u002Fhackread.com\u002Fmicrosoft-gigawiper-backdoor-destroy-windows-pcs\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002Fmicrosoft-gigawiper-backdoor-destroy-windows-pcs-1.jpg","2026-07-09T20:51:32+00:00","2026-07-09T22:00:17.420889+00:00",9,[17,20,22],{"name":18,"type":19},"Windows","product",{"name":21,"type":19},"Microsoft Defender",{"name":23,"type":24},"Microsoft","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":25,"icon":27,"name":28,"slug":29},null,"Malware","malware",[31,36,38,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,52,55],{"type":29,"value":50,"context":51},"GigaWiper","Name of the destructive Windows backdoor",{"type":29,"value":53,"context":54},"Crucio ransomware","Encryption function linked to this ransomware",{"type":29,"value":56,"context":57},"FlockWiper","Older program whose code is recreated in GigaWiper",[23,18,21],{"controls":60,"vendors":136},[61,81,107],{"slug":62,"name":63,"problem":64,"products":65},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[66,73],{"vendor_slug":67,"vendor_name":23,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":82,"name":83,"problem":84,"products":85},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[86,94,99],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":67,"vendor_name":23,"vendor_logo":68,"product_slug":95,"product_name":96,"url":97,"description":98},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":108,"name":109,"problem":110,"products":111},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",[137],{"slug":67,"name":23,"logo_path":68,"roles":138},[139],"reported_by",{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":156},"gigawiper-backdoor-combines-remote-access-with-irreversible-data-destruction","GigaWiper Backdoor Combines Remote Access with Irreversible Data Destruction","GigaWiper represents a dangerous hybrid threat that merges persistent remote access with destructive capabilities, including disk wiping and encryption without any recovery path. The malware disguises itself as a legitimate scheduled task, allowing it to survive reboots and evade casual inspection. What makes this particularly severe is the intentional removal of recovery options — once triggered, data loss is designed to be permanent. Organizations without robust offline backups and behavioral monitoring are especially vulnerable to this kind of destructive payload. This matters because destructive malware can cripple business operations far longer than ransomware, as there is no negotiation path — only restoration from backups.",[145,146,147,148,149,150,151,152,153,154,155],"CIS Control 8 – Audit Log Management","CIS Control 10 – Malware Defenses","CIS Control 11 – Data Recovery","NIST SP 800-61 – Incident Response","NIST CP-9 – Information System Backup","NIST SI-3 – Malicious Code Protection","NIST AU-6 – Audit Review, Analysis, and Reporting","MITRE ATT&CK T1053.005 – Scheduled Task\u002FJob","MITRE ATT&CK T1561 – Disk Wipe","MITRE ATT&CK T1486 – Data Encrypted for Impact","ITIL – Incident Management & Continual Improvement",{}]