GigaWiper is a Go-based backdoor that packs several destructive tools into a single implant. Researchers first spotted it wiping compromised Windows environments in October 2025, with the malware family targeting organizations worldwide. Instead of being one purpose-built tool, GigaWiper stitches together code from at least three older malware families and exposes them as on-demand commands to the operator.

Operators using GigaWiper can quietly gather intelligence on a compromised Microsoft Windows host, then flip to destruction on command — overwriting physical disks, encrypting files with keys that are never saved (a fake ransomware routine with no recovery path), or forcing an unbootable Blue Screen of Death. The GigaWiper implant maintains persistence, communicates over RabbitMQ and Redis, and offers a broad remote-control toolkit that gives attackers hands-on control of infected systems before the destructive payload is triggered.

Dual-Form Go Implant

GigaWiper, also tracked as BLUERABBIT, is a newly identified Windows threat built to do more than steal information or lock a screen. It is a Go-based implant that pairs a full command-and-control backdoor with several built-in destruction routines, and it appears in two closely related forms: standalone wiper binaries and a larger backdoor. Both are unstripped Go portable executables, and the standalone wiper's code is embedded wholesale inside the backdoor as one of its on-demand commands, letting an operator move from a quiet presence to irreversible damage whenever they choose.

Persistence and Command-and-Control Communication

Once running, GigaWiper establishes persistence by creating a registry key at HKCU\SOFTWARE\OneDrive\Environment that tracks how many times it has executed. On first run it creates a scheduled task named OneDrive Update set to fire every minute and again at system startup, then exits; on later runs it recognizes it is executing as that task and continues. It decrypts a hard-coded configuration using AES with a hard-coded key to recover its command-and-control details, then receives operator commands over RabbitMQ (AMQP) and reports status and output back through a Redis server. Its commands are numbered 1 through 20 and span destruction, surveillance, and system management, with a fanout exchange named All broadcasting a command to every infected host at once and a topic exchange named Topic letting operators target specific machines.

Remote-Control Toolkit

Beyond persistence and communication, the GigaWiper backdoor gives operators a broad remote-control toolkit. Command 20 stands up a VNC-style server with keyboard, mouse, and live screen streaming over a chosen TCP port, disguising the firewall rules it needs with names borrowed from legitimate Windows components. Interactive managers for processes (command 16), services (command 17), and the registry (command 18, which keeps session state between requests like an interactive browser) provide hands-on control of a compromised host.

Data Collection and Exfiltration

For data handling, command 4 uses the MinIO Client to upload files to remote S3-compatible storage, while command 15 gathers extensive system information such as IP address, machine GUID, CPU, OS, network configuration, firmware, user details, and installed antivirus products, and returns it through the C2 channel. Screenshots (command 9) and continuous screen recording while the user is active (command 10) round out its collection capability.

Destruction Routines

The operation ends in destruction: command 1 overwrites raw disk content and removes partition metadata before rebooting, command 12 performs a multi-pass secure wipe of the Windows drive, command 3 encrypts files with an unsaved key and renames them with a .candy extension while dropping a threatening wallpaper, and command 2 disables recovery and deletes boot and kernel files to leave the machine unbootable. Command 19 then clears Windows event logs to frustrate incident response.

A Consolidated Destruction Platform

Taken together, these capabilities make GigaWiper less a single tool than a destruction platform: at least three previously separate malware families are folded into one backdoor that can switch from quiet surveillance to irreversible sabotage on demand, all while masquerading as routine OneDrive activity on the compromised Windows platform.