Reported by 1 outlet

Timeline

1. original reporting

   GigaWiper: Destructive Backdoor Stitches Together Crucio Ransomware, FlockWiper Into Single Golang Implant

   microsoft.com · 96d ago · July 10th, 2026

   Microsoft Threat Intelligence published a deep-dive analysis of GigaWiper, a sophisticated Golang-based backdoor observed actively since October 2025 that consolidates three independent malware families into a single modular implant. The backdoor communicates via RabbitMQ (C2) and Redis (status updates), persists through scheduled tasks, and provides 20 distinct commands including disk-level wiping, fake ransomware encryption (keys generated and discarded — no decryption possible), BSOD triggering via boot-file deletion, screen recording, and VNC-style remote control.

   Key architectural finding: GigaWiper is not a purpose-built tool but an amalgamation. Command 1 embeds a standalone physical-disk wiper (overwrites raw disk, removes partition metadata). Command 3 reimplements Crucio ransomware (CISA-advisory-documented, Dec 2023) — encrypts files with random keys that are never saved, renames them .candy, drops a wallpaper image. Command 12 reimplements FlockWiper, a C-based wiper recoded in Golang with multi-pass secure wiping. PDB paths and function names reference a "GRAT" framework, suggesting an unrecovered parent tooling ecosystem.

   C2 infrastructure observed at 185.182.193[.]21 and 212.8.248[.]104. Microsoft has released Defender detections and IOCs.

   Hunting hypothesis: Look for scheduled tasks named "OneDrive Update" running every minute, RabbitMQ/Redis traffic from non-standard ports, and DeviceIoControl with IOCTL_DISK_CREATE_DISK calls — these are the implant's fingerprint for partition-table destruction.

   ---