Executive Summary
Microsoft and Binary Defense have detailed a sophisticated Golang-based backdoor known as GigaWiper (also tracked as BLUERABBIT), appearing in destructive campaigns around October 2025. This malware is an amalgamation of several standalone tools, including components from Crucio ransomware and FlockWiper, consolidated into a single modular implant. Attribution points toward IRGC-affiliated cyber actors, specifically groups like CyberAv3ngers and Handala Hack, who have previously targeted critical infrastructure.
The backdoor provides operators with extensive control, allowing for espionage, data exfiltration via MinIO, and total system destruction. It features three distinct destructive modes: physical disk wiping, multi-pass Windows drive overwriting, and a fake ransomware module that encrypts files with non-recoverable keys. The shift towards unified platforms indicates a focus on operational efficiency and flexibility, allowing actors to pivot from quiet intelligence gathering to overt destruction within a single intrusion.
The impact is significant for targeted sectors, particularly within Israel and critical infrastructure internationally. Because GigaWiper destroys partition tables and encrypts data without saving keys, recovery is impossible without offline backups. Organizations should prioritize early detection of its persistence mechanisms and C2 traffic, which often masquerades as legitimate business services like RabbitMQ and Redis.