The wiper that bundles three flavors of destruction into a single backdoor

GigaWiper is not a single-purpose wiper. It is three separate families stitched together as on-demand backdoor commands. Microsoft found that the standalone wiper binary it first spotted in October 2025 was just one component of a larger backdoor that also reimplemented code from two older malware families: Crucio ransomware and FlockWiper, a C-based wiper ported to Golang. The consolidation mirrors trends seen in modern ransomware operations that bundle multiple extortion tactics.

The backdoor communicates over RabbitMQ for commands and Redis for status updates. It sets persistence via a scheduled task named OneDrive Update, tracks its execution count in the registry, and offers attackers 20 commands ranging from screen recording to disk wiping. This kind of modular architecture is becoming more common as adversaries learn from how AI agents automate cyber operations.

The three wipers inside

Beyond the standalone disk wiper (command 1), GigaWiper includes two additional destructive commands:

• Command 3 encrypted files with AES-CBC using random keys that are never saved, renamed them with a .candy extension, and dropped a wallpaper image. Microsoft traced this function, BigBangExtortMain, directly to Crucio ransomware documented in a December 2023 CISA advisory. The malware had no mechanism or intention to decrypt files, a hallmark of purely destructive ransomware that serves no recovery path.
• Command 12, WipeCMain, wipes only the Windows installation drive using multi-pass overwriting. Microsoft identified this as a Golang reimplementation of FlockWiper, a C-based malware first uploaded to VirusTotal in June 2025. The PDB paths in FlockWiper samples reference “GRAT”, a string that also appears in several GigaWiper function names.

The presence of all three makes GigaWiper a wiper Swiss Army knife: the attacker picks which flavor of destruction fits the target.

How the backdoor operates

GigaWiper uses two communication channels. It receives commands over RabbitMQ via AMQP, with a fanout exchange named “All” for broadcasting and a topic exchange for targeted commands. It uploads results to a Redis server. One observed sample connected to C2 at 185.182.193[.]21 on port 5544 for RabbitMQ and 7542 for Redis.

It sets persistence by creating a scheduled task that runs every minute and on system startup. The backdoor tracks its execution count in HKCU\SOFTWARE\OneDrive\Environment. On first run it creates the task and exits; subsequent runs continue normally.

Commands include file encryption, screenshot capture, screen recording, process management, registry manipulation, event log clearing, and even a VNC-like server for remote control. Such a broad command set aligns with what defenders see in Microsoft’s accelerated patch cycles aimed at closing the gaps these tools exploit.

The evidence trail

Microsoft publicly shared SHA-256 hashes for multiple GigaWiper samples, Crucio, and FlockWiper. A sampler:

C2 IPs include 185.182.193[.]21 and 212.8.248[.]104.

Operational shift

Microsoft noted that the consolidation of multiple destructive capabilities into a single backdoor reflects a notable shift. Wipers are typically designed purely to destroy, not to extort or maintain persistence. GigaWiper lets the actor move from espionage to destruction on demand, reducing the deployment footprint. This operational efficiency echoes what researchers observed in AI-powered phishing campaigns that also consolidate tooling for better logistics.

Google Threat Intelligence Group and Binary Defense track the same activity as BLUERABBIT. Microsoft shared detections for Defender Antivirus and Defender for Endpoint, including alerts such as ‘GigaWiper’ malware was detected and ‘FlockWiper’ malware was detected.

Defense recommendations

Microsoft advised organizations to enable tamper protection, block direct access to known C2 infrastructure, turn on cloud-delivered protection, and run EDR in block mode. Attack surface reduction rules can also harden environments against the techniques GigaWiper uses. For a deeper look at autonomous defense strategies, see how AI agents are rewriting cybersecurity.