Microsoft’s Threat Intelligence team published detailed analysis on 9 July 2026 of a modular Windows backdoor they call GigaWiper, an implant that folds disk wiping, fake ransomware, and live spyware into a single remotely-controlled payload. Binary Defense and Google’s Threat Intelligence Group separately documented the same malware under the name BLUERABBIT in March 2026. Both teams attribute GigaWiper to an Iran-nexus threat actor that has been operating against Israeli organisations since at least October 2025.
A Backdoor Built to Destroy
GigaWiper is written in Go and runs on Windows. Its design reflects a deliberate architectural choice: rather than being a purpose-built tool, it assembles capabilities from multiple pre-existing malware families into a remotely invocable command set. Once planted, operators can choose their mode of attack.
Three destructive capabilities are available on demand:
Raw disk wipe. The first mode operates at the physical drive level, overwriting raw disk content and removing partition metadata before forcing a reboot. There is no file-by-file deletion to reverse: the drive is unreadable when the machine restarts.
Fake ransomware. The second mode is built on code derived from a malware family called Crucio. It encrypts files and appends a .candy extension, changes the desktop wallpaper to an alarming warning image, and presents every visual signal of a ransomware infection. The critical difference: no ransom note is generated, and the encryption key is never saved. The “ransomware” appearance is a ruse; the actual goal is irreversible destruction. Victims who pay a ransom to a phantom attacker will not recover their files.
Multi-pass drive wipe. The third mode is a Go reimplementation of FlockWiper, a previously documented C-based wiper, extended with multiple overwrite passes for more thorough data destruction.
Beyond the destructive capabilities, the same backdoor provides persistent surveillance: screenshots of all monitors, continuous screen recording while a user is active, and a hidden VNC session for real-time remote desktop access.
Infrastructure and Persistence
Command-and-control uses RabbitMQ over AMQP to deliver instructions to the implant. Redis handles command status updates and output. The backdoor establishes persistence through a scheduled task named “OneDrive Update” that fires every minute and runs at startup — a masquerade designed to blend with legitimate Microsoft service activity in task scheduler logs.
Escalation Since Operation Epic Fury
The timing and targeting of GigaWiper are consistent with a broader escalation of Iranian cyber operations that began following Operation Epic Fury, the coordinated US-Israel military strikes on Iran that commenced on 28 February 2026. Iranian-nexus wiper activity against Israeli targets increased sharply in the period following those strikes, as destructive cyber operations became a primary retaliatory vector.
GigaWiper is not the only Iranian wiper active in this environment. Unit 42 at Palo Alto Networks documented a parallel surge of wiper activity attributed to a separate Iran-affiliated hacktivist group, Handala Hack, which conducted a destructive campaign against Stryker Corporation in March 2026, remotely erasing more than 200,000 devices across 79 countries. Stryker’s exposure illustrates the geographic reach that supply-chain and cloud-connected access enables: targeting an Israel-linked enterprise can produce destructive effects on a global footprint.
Sector Implications
Organisations in the critical infrastructure, healthcare, and communications sectors with Israeli operations or significant Israeli business relationships should treat GigaWiper as an active threat. The dual nature of the implant — surveillance followed by on-demand destruction — means intrusions may have a dwell phase before any destructive command is issued. Network defenders who detect RabbitMQ connections or Redis queries from endpoints that should not be running those services, or see scheduled tasks named “OneDrive Update” that do not correspond to legitimate Microsoft sync activity, should investigate promptly.
Recommended Actions
- Audit scheduled tasks across Windows endpoints for entries named “OneDrive Update” that do not correspond to the Microsoft OneDrive sync process
- Monitor for outbound AMQP (port 5672/5671) and Redis (port 6379) traffic from endpoints, particularly in segments that process sensitive data
- Enforce tamper protection on endpoint security tools to prevent GigaWiper’s destructive commands from silencing them before execution
- Ensure offline, air-gapped backup coverage for critical systems; disk-level wipers render in-system snapshots and locally-connected backups unrecoverable
- Brief incident response teams on the fake ransomware masquerade: investigation and recovery approaches for GigaWiper victims differ materially from genuine ransomware incidents