New GigaWiper Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware

The GigaWiper (BLUERABBIT) backdoor represents a sophisticated convergence of destructive capabilities — disk wiping, fake ransomware, and spyware — likely deployed by an Iran-nexus threat actor targeting Israeli organizations. By bundling multiple attack vectors into a single payload, attackers can simultaneously destroy data, deceive incident responders into treating the incident as ransomware, and exfiltrate sensitive information before destruction. This multi-stage approach significantly complicates forensic investigation and delays effective incident response. The use of fake ransomware as a decoy is particularly dangerous because it misdirects recovery efforts toward negotiation rather than containment and restoration. Organizations without robust backups and endpoint detection may face unrecoverable data loss.