Back Blogs.Microsoft

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

Blogs.Microsoft •Microsoft Threat Intelligence • July 9, 2026

GigaWiper is a destructive backdoor that combines multiple wiping and ransomware-like capabilities into a single operational platform. This blog analyzes how the malware incorporates code from several previously separate malware families and provides guidance to help defenders detect and defend against similar threats.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Unveils GigaWiper: A Modular Destructive Backdoor for Windows Microsoft has revealed GigaWiper, a destructive Windows backdoor that integrates components from three malware families, including Crucio and FlockWiper. This Golang-based malware is designed for post-initial access attacks, allowing operators to execute commands for system destruction, including raw disk wiping and fake ransomware. GigaWiper disguises itself as OneDrive and utilizes legitimate services for command and control, complicating detection efforts. It can take screenshots, record screen activity, and manipulate event logs to hide its presence. Microsoft links the malware to Iranian threat actors, suggesting a state-sponsored motive targeting Israeli organizations. The malware's modular design enables attackers to switch between espionage and sabotage seamlessly. Early detection and secure backups are critical for defense against this threat. 13 sources 73

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

The full story

Extracted Entities

Attack Types (1)

Malware (1)