[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAROT2V6GcdC-6pxk9f6qOmjqreiCqKyDXtXRZQNpDRM":3},{"article":4,"iocs":47,"watch_terms":62,"solutions":63,"lesson":159},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":24,"category":25,"article_tags":29},"3daf8481-b765-4df3-9277-198a512c727d","New GigaWiper Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware","new-gigawiper-windows-backdoor-bundles-disk-wiping-fake-ransomware-and-spyware-eb95a6","Microsoft has taken apart a destructive Windows backdoor it calls GigaWiper. What stands out is how it is built: not one tool but three older destructive programs bolted into one, offered as commands the operator can choose from. Each is a different way to break a machine: wipe the whole disk, overwrite the Windows drive, or run fake \"ransomware\" that scrambles files with a key it never saves","Microsoft has identified a new destructive Windows backdoor named GigaWiper, which consolidates three older destructive tools: a disk wiper, a fake ransomware module, and a drive wiper. This malware, also known as BLUERABBIT, is suspected to be linked to an Iran-nexus group targeting Israeli organizations. Beyond its destructive capabilities, GigaWiper also functions as spyware, collecting sensitive data and providing remote access.","New GigaWiper backdoor combines disk wiping, fake ransomware, and spyware for destructive attacks.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fnew-gigawiper-windows-backdoor-bundles.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiJRuXh4y7zy8C81w_JgJgWFg_sgF0IYcsvqWEsYeHIHu7nWdOl1aIMQdnmmRQF-KJK_XdTGxzSIAr57yFkzMIZ_VK5Kzx12xR4oW8QOZcnsf9zmySIT3YRvpPvo2q-P92sZc2LqB4M-NSlktwLGU85I0JQbCVCjvJ130GLEF6eGknO8VzkK66kHjlgkBg\u002Fs1600\u002Fdata-wiper-malware.jpg","2026-07-09T18:08:07+00:00","2026-07-09T20:00:17.276466+00:00",9,[17,20,22],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":19},"Binary Defense",{"name":23,"type":19},"Google","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":24,"icon":26,"name":27,"slug":28},null,"Malware","malware",[30,35,40,42],{"category":31},{"id":32,"icon":26,"name":33,"slug":34},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":36},{"id":37,"icon":26,"name":38,"slug":39},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":41},{"id":24,"icon":26,"name":27,"slug":28},{"category":43},{"id":44,"icon":26,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48,52,54,56,58],{"type":49,"value":50,"context":51},"hash_sha256","a796f1545f5f81a40077b60885734243839b63973073347556604494303b8260","GigaWiper backdoor hash",{"type":49,"value":53,"context":51},"b2b71207086860689061337000127a426260234413664095c70776c22696203c",{"type":49,"value":55,"context":51},"d26349981610b155e353434337738265445a755006674929411a7c2444c81700",{"type":49,"value":57,"context":51},"e36125792345b7605015a471517975396354f690f6662243804302361173721b",{"type":59,"value":60,"context":61},"url","https:\u002F\u002Fthreatpost.com\u002Fgigawiper-windows-backdoor-bundles-disk-wiping-fake-ransomware-and-spyware\u002F","Article URL",[18,23,21],{"controls":64,"vendors":151},[65,93,122],{"slug":66,"name":67,"problem":68,"products":69},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":87,"vendor_name":18,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":94,"name":95,"problem":96,"products":97},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":123,"name":124,"problem":125,"products":126},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",[152,157],{"slug":153,"name":23,"logo_path":154,"roles":155},"google","\u002Fvendor-logos\u002Fgoogle.png",[156],"reported_by",{"slug":87,"name":18,"logo_path":88,"roles":158},[156],{"slug":160,"title":161,"body":162,"framework_refs":163,"framework_notes":177},"gigawiper-backdoor-combines-wiping-fake-ransomware-and-spyware-in-one-destructive-package","GigaWiper Backdoor Combines Wiping, Fake Ransomware, and Spyware in One Destructive Package","The GigaWiper (BLUERABBIT) backdoor represents a sophisticated convergence of destructive capabilities — disk wiping, fake ransomware, and spyware — likely deployed by an Iran-nexus threat actor targeting Israeli organizations. By bundling multiple attack vectors into a single payload, attackers can simultaneously destroy data, deceive incident responders into treating the incident as ransomware, and exfiltrate sensitive information before destruction. This multi-stage approach significantly complicates forensic investigation and delays effective incident response. The use of fake ransomware as a decoy is particularly dangerous because it misdirects recovery efforts toward negotiation rather than containment and restoration. Organizations without robust backups and endpoint detection may face unrecoverable data loss.",[164,165,166,167,168,169,170,171,172,173,174,175,176],"NIST SP 800-61 Rev. 2 – Incident Response","NIST SP 800-34 – Contingency Planning (Backup & Recovery)","NIST IR-4 – Incident Handling","NIST SI-3 – Malicious Code Protection","CIS Control 11 – Data Recovery","CIS Control 13 – Data Protection","CIS Control 17 – Incident Response Management","CIS Control 10 – Malware Defenses","MITRE ATT&CK T1485 – Data Destruction","MITRE ATT&CK T1486 – Data Encrypted for Impact (Fake Ransomware)","MITRE ATT&CK T1071 – Application Layer Protocol (C2\u002FSpyware)","ITIL – Major Incident Management","ISO\u002FIEC 27035 – Information Security Incident Management",{}]