GigaWiper boot recovery sabotage via bcdedit and reagentc

Ethan Andrews@eandrews

•updated Jul 9, 2026•2•0•4

Detects the use of legitimate Windows tools, bcdedit.exe and reagentc.exe, to disable system recovery mechanisms (boot status policies and the Windows Recovery Environment). This activity is often observed during destructive wiper attacks to prevent system restoration after data destruction.