GigaWiper isn't your garden-variety wiper or RAT—it's a Frankenstein backdoor cobbled from multiple malware families into one Golang package that hands attackers both long-term espionage and on-demand total destruction. Microsoft Threat Intelligence spotted the activity in compromised environments back in October 2025 and detailed how the implant stitches together a physical-disk wiper, a Crucio-derived fake ransomware module that encrypts files then discards the keys, and FlockWiper-style multi-pass overwriting.[[1]](https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/)[[1]](https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/)

The backdoor component adds screen capture, desktop streaming, and remote control via a TCP server while hiding persistence as a scheduled "OneDrive Update" task that fires every minute. It communicates over RabbitMQ and Redis to C2 servers like 185.182.193[.]21, giving operators granular commands to wipe raw disk content, remove partitions, trigger BSODs, or just spy quietly until the moment they decide to nuke the system.[[2]](https://www.malwarebytes.com/blog/news/2026/07/this-new-windows-malware-can-take-over-your-pc-and-wipe-it-clean)

This modular approach is the real story: attackers are consolidating tools to shrink their footprint while expanding options, turning what used to be separate wipers or ransomware into a single implant that can pivot from surveillance to irreversible sabotage without redeploying anything. Home users are mostly in the clear unless already breached, but orgs running unhardened networks just got another reminder that "tamper protection" and EDR aren't optional anymore.