SUBJECT PROFILE
Microsoft Threat Intelligence published a detailed teardown of GigaWiper on July 9, 2026, a Golang Windows backdoor attributed by Binary Defense and Google's Threat Intelligence Group to a likely Iran-nexus cluster (overlapping with CyberAv3ngers based on shared Crucio code fingerprints). GigaWiper is uniquely dangerous as a single implant combining espionage and three distinct operator-selectable destruction mechanisms: raw disk wipe via WMI, multi-pass Windows drive overwrite, and a fake ransomware module (.candy extension) that encrypts files while discarding keys, making recovery impossible. The malware masquerades as Microsoft OneDrive via a scheduled task and registry key, using legitimate services RabbitMQ, Redis, and MinIO for C2 to blend into normal network traffic.
Destructive sabotage and espionage targeting Israeli organizations; retaliatory cyber operations post-Operation Epic Fury
OPERATIONAL HISTORY
T1485 (Data Destruction - disk wipe), T1486 (fake ransomware, no recovery), T1113 (Screen Capture), T1021.005 (VNC), T1070.001 (Clear Windows Event Logs), T1053 (Scheduled Task - OneDrive Update masquerade), T1112 (Registry Modification), T1071 (Application Layer Protocol - RabbitMQ/Redis/MinIO C2), BYOB destruction framework with 20-command numbered protocol, Crucio-derived fake ransomware module
KNOWN INFRASTRUCTURE
Go-language implant tracked as GigaWiper (Microsoft) / BLUERABBIT (Binary Defense/Google GTIG); C2 via RabbitMQ, Redis, MinIO legitimate business services; persistence via HKCU\SOFTWARE\OneDrive\Environment registry key and 'OneDrive Update' scheduled task; firewall rule masquerading as 'Microsoft.Windows.CloudExperienceHost'; shared C2 IPs confirmed across GigaWiper and BLUERABBIT samples; Microsoft released YARA rules and Defender signatures