GigaWiper Windows backdoor merges disk wiping, fake ransomware, and spyware

Intelligence Summary

Microsoft dismantled the GigaWiper Windows backdoor and described its inner design. The malware is assembled from multiple older destructive components that operators can run as commands. It can wipe the whole disk or overwrite the Windows drive to prevent recovery. It can also deploy a fake ransomware routine that scrambles files using a key it never stores. Victims should treat any execution as destructive, ensure reliable offline backups, and validate detections for related behaviors.

Recommended Action

Prioritize immediate review, validate exposure, and patch or mitigate affected systems.

Topics