GigaWiper Modular Backdoor Attributed to Iran-Nexus Actor — Combines Disk Wiper, Fake Ransomware, and VNC Spyware in Single Golang Framework

Microsoft Threat Intelligence published analysis on July 9 of GigaWiper, a Golang-based Windows backdoor active since October 2025 that merges three destructive malware families — the Crucio ransomware (encrypts with unrecoverable keys), a Go reimplementation of FlockWiper (multi-pass disk overwrite), and a standalone raw-disk wiper — into a single modular framework with 20 operator-selectable commands, including continuous screen recording, VNC-like remote control, and Windows event log wiping. Binary Defense independently tracked the same files as BLUERABBIT and, citing Google TAG, attributed the activity to a likely Iran-nexus group targeting Israeli organizations — consistent with a surge in Iranian wiper operations warned about by Israel's National Cyber Directorate in March 2026. The malware establishes persistence as a fake 'OneDrive Update' scheduled task and uses RabbitMQ/Redis for C2, making it structurally difficult to remediate without full offline forensics.

The malware establishes persistence as a fake 'OneDrive Update' scheduled task and uses RabbitMQ/Redis for C2, making it structurally difficult to remediate without full offline forensics.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.