Back Feeds.4Sysops

GigaWiper backdoor merges multiple malware families for disk destruction

Feeds.4Sysops •IT News • July 9, 2026

Microsoft Threat Intelligence has identified GigaWiper, a sophisticated Golang-based backdoor that integrates components from three distinct malware families. This modular implant combines command-and-control capabilities with destructive payloads, including physical disk wiping and fake ransomware routines. By consolidating tools like Crucio and FlockWiper, threat actors can switch between stealthy espionage and immediate system sabotage within a single deployment. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Unveils GigaWiper: A Modular Destructive Backdoor for Windows Microsoft has revealed GigaWiper, a destructive Windows backdoor that integrates components from three malware families, including Crucio and FlockWiper. This Golang-based malware is designed for post-initial access attacks, allowing operators to execute commands for system destruction, including raw disk wiping and fake ransomware. GigaWiper disguises itself as OneDrive and utilizes legitimate services for command and control, complicating detection efforts. It can take screenshots, record screen activity, and manipulate event logs to hide its presence. Microsoft links the malware to Iranian threat actors, suggesting a state-sponsored motive targeting Israeli organizations. The malware's modular design enables attackers to switch between espionage and sabotage seamlessly. Early detection and secure backups are critical for defense against this threat. 13 sources 73

GigaWiper backdoor merges multiple malware families for disk destruction

The full story

Extracted Entities

Attack Types (2)

Malware (3)