GigaWiper, also identified as BLUERABBIT, is a modular Golang-based malware platform designed for long-term espionage followed by irreversible system sabotage. The implant integrates code from three distinct malware families—Crucio, FlockWiper, and a standalone disk wiper—to offer attackers tiered destruction capabilities. It utilizes enterprise-grade messaging protocols, specifically RabbitMQ (AMQP) for command broadcasting and Redis for real-time status updates, to blend C2 traffic with legitimate network operations. The threat represents a strategic shift from traditional data theft to "destruction-on-demand," allowing for deceptive ransomware simulations or industrial-grade data sanitization that renders recovery impossible.
-
Campaign Mechanics & Modular Architecture
- Strategic evolution from single-purpose tools to modular, multi-stage "destruction-on-demand" platforms.
- Hybrid operational model: conducts long-term, low-noise surveillance before triggering terminal destruction.
- Surveillance capabilities include VNC-like remote desktop control (Command 20) and screen recording (Command 10).
-
Technical Composition: The 'Frankenstein' Payload
- Crucio Ransomware: Implements deceptive encryption using the
.candyextension; encryption keys are immediately discarded to prevent recovery. - FlockWiper: A modernized Golang implementation optimized for secure, multi-pass data wiping.
- Standalone Disk Wiper: Performs raw physical disk overwriting and destruction of critical partition metadata.
- Crucio Ransomware: Implements deceptive encryption using the
-
C2 Infrastructure & Persistence Tactics
- Enterprise Protocol Leveraging: Uses RabbitMQ (AMQP) via fanout exchanges for command broadcasting and Redis for real-time updates/status exfiltration.
- Persistence Mechanism: Maintains residency via a scheduled task masquerading as a "OneDrive Update" that executes every minute.
- Network Stealth: Employs standard messaging protocols to ensure C2 communications blend seamlessly into legitimate enterprise traffic.
-
Operational Impact & Destruction Capabilities
- Tiered Sabotage: Offers various destruction modes, including Command 1 (physical disk wipe), Command 2 (disabling Windows recovery and triggering BSOD), and Command 12 (secure multi-pass wipe).
- System Manipulation: Includes commands for process killing (Cmd 16), service manipulation (Cmd 17), and registry navigation (Cmd 18).
- Irreversibility: High-impact destruction modes ensure near-zero data recoverability for targeted systems.
-
Defensive Implications & Detection Challenges
- Evasion Artifacts: Event log clearing (Command 19) prints the hard-coded string "kharbvnmhkjbkjb"; developer fingerprint "GRAT" is embedded in function names and PDB paths.
- Detection Difficulty: High complexity due to the use of legitimate administrative tools and enterprise-grade communication infrastructure.
- Risk Profile: Presents a high risk of prolonged, undetected espionage culminating in total, irreversible system sabotage.
Related posts
- News4Hackers — GigaWiper’s Multi-Stage Malware Attack: System Sabotage Tactics Revealed
- The Register - Security — Destructive Windows backdoor stuffs multiple wipers and ransomware code into a single package
- SecurityWeek — GigaWiper Combines Multiple Malware for System-Level Sabotage
- Microsoft Security Blog — GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware
- csoonline.com — Microsoft uncovers GigaWiper, a backdoor designed for destruction on demand
- SOCFortress — GigaWiper: Destructive Modular Backdoor
- Infosecurity-magazine
- Hivepro
- Secure
- Malwarebytes
- Techradar
- Blog
- Dark Reading — GigaWiper Lets Threat Actors Choose Their Own Destructive Attack