GigaWiper destructive backdoor, HalluSquatting agentic botnets, CISA KEV additions, Helix vishing group, KDDI 12M breach

The defining story is GigaWiper: Destructive Backdoor Stitches Together Crucio Ransomware, FlockWiper Into Single Golang Implant. Microsoft's analysis shows the Golang backdoor, active since October 2025, consolidates three independent families into one modular implant: a raw disk wiper, a reimplementation of the Crucio ransomware that encrypts with keys generated and immediately discarded so no decryption is possible, and FlockWiper recoded in Go. Twenty commands include boot-file deletion that triggers BSODs and screen recording. This is a wiper wearing a ransomware costume, and the likely goals are sabotage and permanent data loss.

The scale story is the KDDI breach, which exposed 12.23 million email addresses and 7.6 million passwords across five ISP subsidiaries through a zero-day in a third-party email component. KDDI Data Breach Impacts 12 Million, Zero-Day in ISP Email System means mandatory password resets for millions of users, and the credential reuse risk extends beyond the telecom's services.

AI-assisted delivery keeps maturing. HalluSquatting weaponizes the tendency of coding assistants to hallucinate repository and package names, with hallucination rates up to 85 percent for clone prompts, turning agent commands into botnet recruitment with no prompt injection required. Operation Muck and Load adds 222 lure repositories across 190 GitHub accounts delivering AsyncRAT, Vidar, and cryptominers through encrypted dead drops. The GhostLock exploit publication and the still-unpatched Tenda backdoor round out the patch queue.

Watchlist: hunt GigaWiper indicators including the OneDrive Update scheduled task and IOCTL_DISK_CREATE_DISK calls, rotate credentials exposed in the ISP email ecosystem, and validate AI tool outputs before execution.