New Giga Wiper Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware
Summary: Microsoft analyzed a Windows backdoor it calls GigaWiper, built in Go and combining three older destructive tools as numbered commands: a full disk wipe, an overwrite of the Windows drive, and fake ransomware that encrypts files with a key it never saves. Binary Defense reported the same four hashes and matching command servers under the name BLUERABBIT, and citing Google's Threat Intelligence Group tied it to a likely Iran-nexus group targeting Israeli organizations, while Microsoft names no country.
Bottom line: The same implant can take screenshots, record the screen, open a hidden VNC session, and wipe event logs before destroying the machine, so finding it tells you nothing about the operator's intent until they act. Microsoft traces the fake-ransomware code to Crucio, listed as suspected ransomware in a December 2023 CISA advisory on CyberAv3ngers, the group linked to Iran's IRGC that took control of a booster station at a Pennsylvania water authority.
Read the original at The Hacker News ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026