GigaWiper Combines Three Wiping Methods With Spyware Capabilities
Summary
Microsoft’s analysis describes GigaWiper, a Windows backdoor combining three destructive methods with surveillance and remote control. Binary Defense links the same samples to BLUERABBIT and, citing Google’s Threat Intelligence Group, assesses a likely Iran-nexus link.
Key points
- GigaWiper offers three destructive options: raw disk wiping, repeated overwriting of the Windows drive, and fake ransomware that encrypts files without saving a recovery key.
- The backdoor can capture screenshots and screen recordings, provide hidden VNC control, collect system details, manage services, edit the registry, and erase Windows event logs.
- It masquerades as OneDrive, creates a scheduled task that runs every minute, and uses RabbitMQ, Redis, and MinIO for command traffic, results, and exfiltration.
- Microsoft and Binary Defense list the same four file hashes and matching command servers for GigaWiper and BLUERABBIT.
- Binary Defense, citing Google’s Threat Intelligence Group, assesses a likely Iran-nexus connection targeting Israeli organizations; Microsoft does not name a country.
- Suggested detection signals include the recurring OneDrive Update task, RabbitMQ or Redis traffic from ordinary desktops, and unexpected use of takeown and icacls on Windows boot files.
- Microsoft recommends tamper protection, endpoint detection in block mode, cloud-delivered protection, automatic remediation, and blocking the two known command-server IPs.
Article Details
- Attack Vectors
- GigaWiper is run after an attacker has gained access to a Windows system; the article does not specify the initial access method.
- The backdoor accepts numbered commands for disk wiping, overwriting the Windows drive, or destructive fake-ransomware encryption.
- The backdoor can take screenshots, record the screen, and provide hidden VNC control.
- GigaWiper uses a recurring OneDrive Update scheduled task for persistence and disguises itself as OneDrive.
- Command traffic uses RabbitMQ for tasking, Redis for results, and MinIO for exfiltration.
- Defensive Notes
- Look for a OneDrive Update scheduled task that runs every minute and the registry key HKCUSOFTWAREOneDriveEnvironment.
- Investigate RabbitMQ or Redis traffic originating from ordinary desktop systems rather than servers.
- Investigate use of takeown and icacls against Windows boot files such as bootmgr and ntoskrnl.exe outside maintenance windows.
- Block the two reported command servers: 185.182.193[.]21 and 212.8.248[.]104.
- Microsoft recommends enabling tamper protection, running endpoint detection in block mode, and enabling cloud-delivered protection and automatic remediation.
- Maintain clean, offline backups; the article says wiped drives and files encrypted without a saved key cannot be recovered through decryption.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 185[.]182[.]193[.]21 | Reported command server that Microsoft recommends defenders block. |
| IPV4 | 212[.]8[.]248[.]104 | Reported command server that Microsoft recommends defenders block. |
MITRE ATT&CK
T1036 · MasqueradingThe backdoor disguises itself as OneDrive and names a firewall rule after Microsoft.Windows.CloudExperienceHost.T1053.005 · Scheduled TaskGigaWiper creates a OneDrive Update scheduled task that runs every minute.T1070.001 · Clear Windows Event LogsThe backdoor can wipe Windows event logs to cover its tracks.T1082 · System Information DiscoveryThe backdoor collects system details from infected systems.T1112 · Modify RegistryThe backdoor can edit the Windows registry, including using a registry key under HKCUSOFTWAREOneDriveEnvironment.T1113 · Screen CaptureThe backdoor takes screenshots of every monitor on an infected PC.T1125 · Video CaptureThe backdoor can record the screen while a user is working.T1219 · Remote Access ToolsA hidden VNC session lets the operator view the display and control the mouse and keyboard.T1485 · Data DestructionGigaWiper overwrites the Windows drive with different data patterns to destroy its contents.T1486 · Data Encrypted for ImpactIts Crucio-based fake-ransomware command encrypts files and adds a .candy extension, but the key is not saved.T1561.001 · Disk Content WipeGigaWiper includes a raw disk wiper that overwrites the physical drive.T1561.002 · Disk Structure WipeThe raw disk wiper wipes the partition table before rebooting.
Threat Actors
CyberAv3ngersThe article describes the group as linked to Iran’s Islamic Revolutionary Guard Corps and reports that it broke into water and energy sites across the US, Israel, the UK, and Ireland in 2023, including taking control of a Pennsylvania water-authority booster station.HandalaUnit 42 tracked a parallel surge of Iran-linked wiper activity against Israel, much of which the article attributes to this separate group.
Malware
BLUERABBITMicrosoft has dissected GigaWiper, a destructive Windows backdoor that combines three wiping methods in one flexible tool, while Binary Defense has linked the same samples to BLUERABBIT.Crucio#GigaWiperFlockWiper#GigaWiperGigaWiperMicrosoft has dissected GigaWiper, a destructive Windows backdoor that combines three wiping methods in one flexible tool, while Binary Defense has linked the same samples to BLUERABBIT.
Vendors
Products
Microsoft OneDriveDetection focuses on OneDrive Update tasks, unusual RabbitMQ or Redis traffic, and known command servers.Microsoft WindowsMicrosoft has dissected GigaWiper, a destructive Windows backdoor that combines three wiping methods in one flexible tool, while Binary Defense has linked the same samples to BLUERABBIT.MinIOFor its command traffic, it skips ordinary web requests and rides on real business services instead: RabbitMQ for tasking, Redis for results, and MinIO for exfiltration.RabbitMQDetection focuses on OneDrive Update tasks, unusual RabbitMQ or Redis traffic, and known command servers.RedisDetection focuses on OneDrive Update tasks, unusual RabbitMQ or Redis traffic, and known command servers.
Tools
Countries
IranThe malware can also spy on infected systems, and its code and infrastructure point to possible ties with Iran-nexus activity targeting Israeli organizations.IrelandThat is the same crew, THN reported, that broke into water and energy sites across the US, Israel, the UK, and Ireland in 2023, logging into internet-exposed industrial controllers.IsraelThat is the same crew, THN reported, that broke into water and energy sites across the US, Israel, the UK, and Ireland in 2023, logging into internet-exposed industrial controllers.United StatesThat is the same crew, THN reported, that broke into water and energy sites across the US, Israel, the UK, and Ireland in 2023, logging into internet-exposed industrial controllers.
Industries
EnergyThat is the same crew, THN reported, that broke into water and energy sites across the US, Israel, the UK, and Ireland in 2023, logging into internet-exposed industrial controllers.waterThat is the same crew, THN reported, that broke into water and energy sites across the US, Israel, the UK, and Ireland in 2023, logging into internet-exposed industrial controllers.