Microsoft Warns GigaWiper Merges Crucio and FlockWiper Code Into Destructive Backdoor

Microsoft has warned of a new destructive malware platform called GigaWiper, a Golang-based backdoor designed to give attackers persistent access, remote control, data collection, and several options for destroying Windows systems.

Microsoft Threat Intelligence first identified GigaWiper activity in October 2025 while investigating compromised environments that had been wiped using destructive tools.

Researchers found both standalone wiper samples and larger backdoor samples. The company said the standalone disk wiper is fully embedded in the backdoor as an on-demand command.

GigaWiper stands out because it is not simply a wiper. It combines components from at least three distinct malware families into a single modular implant.

The malware includes a physical disk wiper, a file-encryption routine based on the Crucio ransomware, and a secure Windows drive wiper that reimplements the logic of FlockWiper.

This approach gives attackers flexibility. They can quietly maintain access and perform surveillance before launching destructive actions, including wiping disks, encrypting files without recovery options, crashing systems, and removing evidence.

Microsoft Flags GigaWiper Backdoor

The standalone GigaWiper binary is an unstripped Windows portable executable written in Go. Rather than deleting selected files, it targets physical disks directly.

The malware uses Windows Management Instrumentation to identify available disks and determine which physical drive contains the Windows installation.

It then attempts to remove partition references from non-Windows disks before overwriting raw disk content.

The wiper writes data in large chunks, using buffers that are mostly zero-filled but contain a randomized first byte. Microsoft said this may help the malware avoid defenses looking for obvious full-disk zeroing activity.

Although the operation resembles ransomware, victims cannot recover their files because the attackers do not retain the decryption material.

Microsoft linked this component to Crucio ransomware based on shared code, function names, and execution flow. Crucio was previously documented by the U.S. Cybersecurity and Infrastructure Security Agency in a 2023 advisory.

Microsoft also found that GigaWiper’s Windows-drive wiping routine closely matches FlockWiper, a C-based wiper first uploaded to VirusTotal in June 2025.

In GigaWiper, the logic was reimplemented in Golang and updated with additional secure-wiping functions. The malware receives attacker commands via RabbitMQ over AMQP and sends command output and status updates via Redis.

It supports broadcast commands through a RabbitMQ fanout exchange named “All” and can receive targeted instructions through a topic exchange.

Microsoft observed GigaWiper infrastructure at 185.182.193[.]21, including RabbitMQ communications on port 554455445544 and Redis communications on port 754275427542. Another associated command-and-control address is 212.8.248[.]104.

Its command set supports screenshots, screen recording, PowerShell execution, system profiling, process and service management, Registry operations, log clearing, file uploads, and VNC-like remote access.

It can also trigger a blue screen and prevent the system from booting by turning off recovery and deleting critical Windows boot and kernel files.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.