“GigaWiper exemplifies threat actors investing in operational efficiency, merging standalone tools into unified platforms that reduce their deployment footprint while expanding their destructive capabilities,” Microsoft researchers wrote.
GigaWiper's combined espionage and destructive capabilities
Microsoft Security's analysis, published on July 9, describes GigaWiper as a multi-purpose backdoor that couples quiet espionage functions with a suite of destructive options. The implant, written in the Go programming language, provides robust command-and-control (C2) capabilities that let an operator maintain control over infected systems, execute commands, deploy additional tooling and — on demand — trigger one of several destructive commands.
In its full incarnation GigaWiper supplies multiple wiping functionalities, including a file-encrypting ransomware mode that deliberately leaves no way to decrypt affected files. Researchers also observed destructive payloads that operate at the physical disk level and other forms of system-level sabotage and fake ransomware.
Built from components of Crucio, FlockWiper and an unrecovered element
Microsoft's researchers assessed that GigaWiper was created by combining and reimplementing components from at least three previously separate malware families. Two of those families are named: the Crucio ransomware strain and FlockWiper. The third component or framework has not yet been recovered.
Specific reimplementations include a destructive command derived from Crucio that encrypts files with randomly generated keys that are never saved — a design that makes decryption impossible — and a wiping command that reimplements FlockWiper's logic in Golang while adding multi-pass secure wiping. The overall architecture consolidates previously separate destructive techniques into a single modular backdoor.
Samples observed and timeline
Microsoft Threat Intelligence detected activity linked to GigaWiper in October 2025, observing compromised environments being wiped with destructive tooling. The research team reported two observed sample types: standalone wiper binaries and larger binaries that combine robust backdoor functionality with multiple destructive capabilities.
Microsoft did not share information about the specific victims or the targeted systems in its published analysis. The public record from Microsoft therefore documents the tools and techniques but not the operational reach or attribution of the incidents in which they were used.
Operational shift: from single-purpose wipers to unified platforms
Microsoft frames GigaWiper as a notable shift in wiper malware, which historically has been “designed purely to destroy.” By merging wiping, encryption and C2 into a modular backdoor, the operators gain flexibility: they can choose a physical disk overwrite, a Crucio-derived encryptor that leaves no recovery path, or a FlockWiper-style multi-pass wipe — all from a single implant. The consolidation is described as an investment in operational efficiency that reduces deployment footprint while expanding destructive options.
Microsoft's mitigation recommendations and product-specific guidance
- Enable tenant-wide tamper protection to prevent attackers from stopping security services or setting antivirus exclusions.
- Block direct access to known C2 infrastructure where possible, guided by an organization’s threat intelligence sources.
- Turn on cloud-delivered protection in antivirus products to cover rapidly evolving attacker tools and techniques.
Microsoft also published product-specific steps for its customers:
- Run endpoint detection and response (EDR) in block mode so Microsoft Defender for Endpoint can block malicious artifacts even when non-Microsoft antivirus does not detect the threat or when Microsoft Defender Antivirus is running in passive mode.
- Allow investigation and remediation in full automated mode so Microsoft Defender for Endpoint can take immediate action on alerts and reduce alert volume.
- For Microsoft Defender XDR customers, implement the attack surface reduction rule: “Block executable files from running unless they meet a prevalence, age, or trusted list criterion.”
What this means for technologists, enterprises, and end users
- Technologists and security teams: The report highlights controls to prioritize — tamper protection, cloud-delivered protection and EDR block mode — because GigaWiper consolidates multiple destructive options behind a C2-capable backdoor.
- Enterprises and procurement leaders: Organizations should ensure their threat intelligence and blocking capabilities can act on known C2 infrastructure and consider automated remediation settings to reduce response time and alert volume.
- End users and the general public: The mitigations Microsoft recommends are primarily organizational controls (tenant-wide settings, EDR modes and attack surface reduction rules) rather than individual-user actions; the published guidance emphasizes protections applied at the enterprise level.
GigaWiper represents a tactical consolidation of destructive and espionage capabilities into one platform, and Microsoft’s analysis documents both the technical mechanisms and a short list of operational mitigations. The company publicly identified the toolset and its origins in October 2025 detection and July 9 publication, but withheld victim and targeting details — leaving the scale and impact of deployments an open question for defenders who must now harden environments against a multi-function wiper-backdoor hybrid.
Original Microsoft Security analysis as reported by Infosecurity Magazine
