Microsoft’s threat intelligence team published a detailed analysis of GigaWiper on July 9, 2026 — a modular Windows backdoor that combines full surveillance capabilities with three independent disk destruction mechanisms. The malware, attributed by Google’s Threat Intelligence Group to an Iran-nexus operator, was first identified in October 2025 during investigations of wiped enterprise environments.
What makes GigaWiper architecturally dangerous is that the same implant performing surveillance is already armed to destroy. An organization that discovers GigaWiper running in apparent monitoring mode — capturing screenshots, streaming the desktop via VNC, exfiltrating data — has not found a malware investigation. They’ve found a business continuity emergency, because the operator’s next command may be irreversible destruction, and no additional payload delivery is required.
Three Destruction Mechanisms, One Dependency
GigaWiper supports 20 command codes. Three of them destroy machines:
Command 1 uses Windows Management Instrumentation to enumerate physical disks, removes partition metadata, then overwrites raw disk content in large chunks across all drives before forcing a reboot. The disk structure itself is erased.
Command 3 encrypts files and appends a .candy extension, changes the desktop wallpaper to a ransom demand, and makes the result look exactly like conventional ransomware. It’s not. The encryption keys are generated randomly and never saved. Decryption is structurally impossible. The display exists to mislead incident responders into treating an irrecoverable system as a negotiation case. Microsoft traced this module directly to Crucio ransomware via a shared function name.
Command 12 targets the Windows installation drive specifically, applying multiple overwrite passes with alternating byte patterns — zeroed data, 0xFF, then random bytes — implementing a secure-erase approach equivalent to established data sanitization standards. Microsoft assessed this to be a Go reimplementation of FlockWiper based on near-identical logic and shared strings.
All three mechanisms share one technical requirement: they must perform write operations to the Windows file system. Command 1 writes to raw disk. Command 3 writes encrypted file content. Command 12 writes overwrite patterns. There is no way to destroy a disk without write access.
Block the Write, Stop the Attack
FileSure Defend operates at the Windows kernel level via a filter driver that intercepts file system operations before they complete. Every file open, read, write, delete, create, and rename operation passes through FileSure’s policy engine before reaching the disk.
The most upstream intervention point is payload delivery. GigaWiper has to land on disk before it can execute. That delivery happens through a vector — email attachment opened in Outlook, browser download, remote desktop session, compromised software update. FileSure blocks the write operation that creates the executable payload if the delivering application isn’t authorized to write executable file types to that location.
A simple rule configuration prevents the entire attack chain:
- File name filter:
*.exe, *.dll, *.vbs, *.ps1(executable file types) - Operations: Write, Create
- Programs excluded: Authorized deployment tools, software update services, IT admin accounts during maintenance windows
- Drive type: Hard drives, Network drives
- Action: Block and alert
The browser downloading GigaWiper attempts to write the executable to disk. The write operation is intercepted. The program performing the write (the browser) is not on the authorized list. The operation is blocked before the file is created. The payload never lands. The backdoor never executes. Surveillance, exfiltration, and destruction never happen.
If the payload somehow bypasses delivery controls — perhaps delivered by an authorized tool that was itself compromised — FileSure provides a second layer. The moment GigaWiper executes any of its three destruction commands, those operations require writing to the file system. A threshold rule detects bulk write or rename operations and blocks further damage:
- File name filter:
*(all files) - Operations: Write, Rename/Move
- Drive type: Hard drives, Network drives
- Threshold: 20 matches within 60 minutes
- Action: Block subsequent operations, alert immediately
Normal user activity — saving documents, editing spreadsheets — falls well below 20 file modifications per hour. Ransomware encryption or disk wiping modifies hundreds of files per minute. The threshold fires within seconds. Subsequent write and rename operations are blocked. Damage is contained to the files modified before the threshold triggered.
Why Detection Alone Fails This Threat Model
Microsoft’s report states that discovering GigaWiper in any operational mode represents the same threat level as finding an active wiper, because the operator’s next command may be destruction and no new payload delivery is required. That assessment is correct if your security model depends on detecting threats after they land.
FileSure doesn’t detect GigaWiper. It controls what’s allowed to happen to files on Windows systems. The malware’s sophistication — its modular architecture, its use of legitimate enterprise messaging platforms for command-and-control, its OneDrive impersonation persistence mechanism — is irrelevant if it can’t write to the file system in the first place.
The standard incident response timeline — detect, investigate, contain — collapses when the detection event and the destruction capability exist in the same implant. FileSure eliminates that timeline entirely by preventing the operations the attack depends on, regardless of which specific malware family is attempting them.
GigaWiper is new. The file write operations it requires are not. FileSure has been blocking those operations for 20 years, on every Windows version from XP through Windows 11 and Server 2003 through Server 2022. A rule written today stops GigaWiper. The same rule stopped Crucio in 2023 and will stop whatever modular wiper gets assembled next year.
Start your free 21-day trial at bystorm.com and see FileSure block unauthorized file operations in your own environment. Install it, open a Word document, and check the console. That’s the product working. Everything else is deciding how much of it you want to use.
Source: GigaWiper: Modular Windows Backdoor Combines Disk Wiper, Fake Ransomware, Spyware
Category: Ransomware
Tags: gigawiper, disk wiper, fake ransomware, crucio, flockwiper, iran nexus, kernel filter driver, file system security
