GigaWiper Windows backdoor merges disk wiping, fake ransomware, and spyware

Intelligence Summary

Microsoft dismantled the GigaWiper Windows backdoor and described its inner design. The malware is assembled from multiple older destructive components that operators can run as commands. It can wipe the whole disk or overwrite the Windows drive to prevent recovery. It can also deploy a fake ransomware routine that scrambles files using a key it never stores. Victims should treat any execution as destructive, ensure reliable offline backups, and validate detections for related behaviors.

Recommended Action

Inventory where Microsoft runs in your environment and treat this as an active remediation item. Until then, watch authentication and outbound traffic logs for the indicators described in the source. This signal rests on a single report, so corroborate it before acting on anything irreversible.

Topics