When a Windows machine is compromised by GigaWiper, the files it holds are gone. Not encrypted, not held for ransom: the disk is wiped, the partition table is overwritten, the operating system is destroyed. The fake ransomware screen that appears after encryption is theatre. There is no decryption key, there was never a ransom negotiation pathway, and the ".candy" extension on the encrypted files is a distraction. The goal is destruction, and the goal is achieved before most victims understand what they are looking at.
GigaWiper, also tracked as BLUERABBIT by Binary Defense, was first detected by Microsoft Security in October 2025. Binary Defense initially detected the malware in March 2026, and the joint analysis attributing it to an Iran-nexus threat group linked to the Islamic Revolutionary Guard Corps was published in July 2026. The connection to CyberAv3ngers, the same group that disrupted water and energy infrastructure in the United States, Israel, the United Kingdom, and Ireland in 2023, provides context for why this backdoor was designed to destroy rather than extort.
GigaWiper is written in Go and implements three distinct destruction methods that are deployed in sequence or combination depending on what the operator instructs the malware to execute.
The first is a raw disk wiper that operates below the file system. Rather than deleting files or destroying file system metadata, it overwrites the physical drive directly and wipes the partition table. At this level, recovery is not a matter of undeleting files or restoring a backup from the disk itself: the data is gone and the information needed to find it has been destroyed. Recovery requires restoring from an off-device backup, and even then, the machine requires a full operating system reinstall before it can function again.
The second component, the fake ransomware module, is based on Crucio, a destructive malware strain that appeared in a CISA advisory in December 2023. It encrypts files with the .candy extension and modifies the desktop wallpaper to display a warning image. The display mimics the initial stage of a ransomware attack: files are renamed, the wallpaper changes, the victim sees what looks like a familiar ransomware interface. But there is no ransom note, no contact address for payment, no decryption key, and no mechanism to recover the encrypted files even if a victim were willing to pay. The encryption is one-way destruction packaged in the visual vocabulary of reversible ransomware.
The third wiper is a rewrite of FlockWiper, a Windows-specific wiping utility. It performs multi-pass overwriting of the Windows drive using multiple data patterns, which increases the difficulty of forensic recovery by overwriting the same physical locations multiple times with different content rather than a single pass of zeros or a single random pattern.
Before destruction, GigaWiper spies. The malware bundles extensive espionage capabilities alongside its wiping tools, enabling operators to collect intelligence from the environment before triggering the destructive payload. This sequencing reflects the operational purpose of the tool: first understand the environment, then destroy it at a moment chosen for maximum impact.
The espionage capabilities include screenshot capture from all connected monitors at intervals, screen recording during periods of user activity, hidden VNC sessions that enable the operator to view the display and send input in real time without the user's knowledge, process and service management for operational control of the system, registry editing for configuration changes and persistence, and Windows event log deletion to cover tracks before the destructive phase begins. Keylogger stubs and additional wiper modules were also detected in the malware's code, indicating capabilities that exist in a dormant or partially implemented state alongside the active components.
The presence of dormant keylogger stubs is an indicator of ongoing development rather than a finished tool. GigaWiper appears to be a maturing platform that will gain additional capabilities over time, not a single-purpose destructive payload. The operator group's choice to combine long-duration espionage capability with endpoint destruction in a single tool is consistent with the approach of state-affiliated groups conducting hybrid operations: collect intelligence over an extended period, then use the access established during collection to execute a destructive operation at a strategically chosen moment.
The command-and-control architecture of GigaWiper is designed to evade detection by security tools that look for communication patterns associated with known malware infrastructure. Rather than connecting to attacker-controlled IP addresses or domains that might appear in threat intelligence feeds, GigaWiper uses three legitimate enterprise software services for its communications.
RabbitMQ, an open-source message broker widely used in enterprise application development, carries tasking and commands from the operator to the malware. Redis, an in-memory data store used extensively in web application backends and caching layers, carries results and exfiltrated data from the malware back to the operator. MinIO, an S3-compatible object storage service often deployed on-premises as an alternative to cloud storage, serves as the staging area for collected data before exfiltration.
This architecture means that GigaWiper's network traffic is indistinguishable in protocol from legitimate enterprise application traffic. AMQP traffic to a RabbitMQ instance, Redis protocol traffic to a Redis server, and S3 API calls to a MinIO endpoint are all normal patterns in environments that use these technologies. Security tools that block traffic to known-bad IP addresses or domains will not flag traffic to the specific addresses used by GigaWiper's C2 infrastructure unless those specific addresses appear on a threat intelligence list.
The two known C2 server addresses, 185.182.193[.]21 and 212.8.248[.]104, are the network indicators available from the joint Microsoft-Binary Defense analysis. Blocking or monitoring for connections to these specific addresses is the current signature-based detection option. Behavioural detection, identifying RabbitMQ, Redis, or MinIO traffic originating from processes that are not legitimate applications using those services, is the detection approach that generalises beyond the currently known C2 infrastructure.
GigaWiper establishes persistence through a scheduled task named "OneDrive Update" that executes every minute. The name is a deliberate choice: OneDrive is a Microsoft service that appears in scheduled tasks on many Windows machines, and an "OneDrive Update" task is unlikely to draw attention from a user reviewing their scheduled tasks list. The malware also stores persistence configuration in the Windows registry under HKCU\SOFTWARE\OneDrive\Environment, the same registry path one would expect legitimate OneDrive configuration to occupy.
Firewall rules added by GigaWiper masquerade as rules for "Microsoft.Windows.CloudExperienceHost", a legitimate Windows component. This spoofed rule allows the malware's network traffic to bypass Windows Firewall enforcement without creating an obviously malicious rule entry. Together, the OneDrive task name, the OneDrive registry path, and the CloudExperienceHost firewall rule constitute a three-layer camouflage designed to blend the malware's footprint into the normal noise of Windows system configuration.
Binary Defense's attribution link to CyberAv3ngers, citing Google Threat Intelligence analysis, places GigaWiper in a threat actor context that is highly relevant to critical infrastructure operators. CyberAv3ngers is linked to the Iranian Islamic Revolutionary Guard Corps and gained attention in late 2023 for attacks on internet-connected programmable logic controllers in water and energy facilities in multiple countries. Those attacks exploited default credentials on Unitronics PLCs and resulted in operational disruptions at water treatment facilities.
A group with a track record of attacking operational technology in critical infrastructure deploying a sophisticated Go-based backdoor with disk wiping, VNC streaming, and process management capabilities represents a capability evolution from the 2023 campaigns. The prior attacks exploited default credentials on internet-facing OT hardware, a relatively simple technique. GigaWiper represents a more capable and stealthy tool suite, suggesting investment in advanced capabilities by the same actor or their sponsors.
For organisations in sectors that CyberAv3ngers has previously targeted, energy, water, and associated industrial sectors, the GigaWiper disclosure is a specific threat actor update that justifies a review of detection capabilities against the technical indicators published in the Microsoft and Binary Defense analyses. For all organisations, GigaWiper's fake-ransomware component is a reminder that responding to apparent ransomware with the assumption that decryption is possible may be the wrong mental model: some attacks dressed as ransomware are pure destruction from the start.
The standard enterprise incident response playbook for malware assumes that the malware's goal is persistence, data theft, or encryption for ransom, all scenarios where remediation involves removing the malware, rotating credentials, and either recovering encrypted data from backups or paying a ransom as a last resort. GigaWiper's multi-stage destruction model, raw disk wipe plus multi-pass data overwrite, requires a different recovery model because the data recovery options that exist for ransomware do not apply to wiped disks.
For a partition table wipe, recovery depends on the backup situation. If the organisation has current backups of the affected systems stored off the affected machines, whether in a separate backup system, in cloud storage, or on offline media, the recovery path is to reimage the machines from backup. The time cost is the time to restore from backup, not the time to decrypt or recover data from the wiped disk. For a machine where the FlockWiper multi-pass overwrite has been applied, forensic recovery of overwritten data is not possible with current technology. The multi-pass overwrite is specifically designed to defeat forensic recovery attempts.
The practical implication for business continuity planning is that GigaWiper changes the severity calculus for the backup coverage question. Organisations that answer "we have backups" without specifying the backup location, the backup age, and the backup scope should audit those answers in light of GigaWiper's capabilities. Backups stored on the same network as the compromised machines are likely accessible from the GigaWiper operator's position: the same espionage phase that precedes the destructive trigger would give the operator visibility into the backup infrastructure, and the destructive phase could target backup systems as well as primary systems. The backup topology that matters for recovery from GigaWiper is one where backups are kept in a location that is not directly reachable from a compromised endpoint: offline backups, immutable object storage with access controls that prevent modification from the production environment, or backup systems in an isolated network segment.
The espionage phase of GigaWiper, which precedes the destructive trigger, generates detection signals that are distinct from both legitimate OneDrive behaviour and from other common malware patterns. The combination of the OneDrive masquerade with specific behavioural signals is the detection opportunity.
The scheduled task "OneDrive Update" executing at one-minute intervals is more frequent than legitimate OneDrive sync behaviour. Monitoring for scheduled tasks named with Microsoft product names that execute at very short intervals is a detection rule that catches this persistence mechanism without requiring knowledge of GigaWiper specifically. The registry path HKCU\SOFTWARE\OneDrive\Environment is accessible to user-level monitoring, and the presence of values in that path created by processes that are not the legitimate OneDrive executable is a detectable anomaly.
The firewall rule spoofing Microsoft.Windows.CloudExperienceHost can be detected by auditing Windows Firewall rules for entries where the application path in the rule points to a non-standard executable location rather than to the legitimate CloudExperienceHost.exe path in the Windows System32 or Program Files directory. Endpoint detection tools with Windows Firewall rule monitoring can alert on rules that reference executables from unusual locations or where the application name in the rule does not match a known legitimate application at that path.
The C2 communications over RabbitMQ, Redis, and MinIO protocols to the known C2 addresses (185.182.193[.]21 and 212.8.248[.]104) are the network-level detection signal. Blocking these IP addresses at the perimeter is the immediate network control. Organisations that run legitimate RabbitMQ, Redis, or MinIO deployments internally should also check whether any traffic to these specific external addresses has appeared in their network logs during the period before the GigaWiper disclosure. Detection of historical traffic to these addresses would indicate a compromise that began before the advisory and should trigger immediate forensic investigation of the systems that generated that traffic.
The decision by GigaWiper's operators to present the destructive payload as ransomware is operationally deliberate. When security teams and executive leadership observe file extensions change, a wallpaper warning appear, and files become inaccessible, the immediate assumption is ransomware. The incident response reflex for ransomware is to look for a ransom note, to assess the scope of encryption, and to evaluate whether decryption is possible, either by recovering backups or by paying the ransom as a last resort.
That reflex delays the recognition that the attack is not ransomware and that decryption is not an option. In the time spent searching for a ransom note that does not exist, evaluating a payment pathway that does not exist, and considering whether backups can be used to decrypt rather than to restore, the multi-pass FlockWiper overwrite is potentially completing its pass through the data. Every minute spent on the ransomware response playbook rather than the destructive attack playbook is a minute in which the correct response, isolating the affected system and stopping the spread to connected systems, is delayed.
Organisations should review their incident response procedures to include an early decision gate that distinguishes between ransomware and destructive malware masquerading as ransomware. The specific indicators that distinguish GigaWiper from genuine ransomware include: the absence of a ransom note, the absence of a payment address or contact mechanism, the .candy extension (which does not correspond to any known ransomware family with a functioning payment infrastructure), and the simultaneous occurrence of partition table overwrite alongside the visible encryption behaviour. If a network connection to RabbitMQ, Redis, or MinIO endpoints at the known C2 addresses is detected in network logs, that is a strong indicator that the incident is GigaWiper-related rather than conventional ransomware.
The attribution to CyberAv3ngers, an IRGC-affiliated group with a documented history of targeting water and energy infrastructure, gives GigaWiper a sector relevance beyond its technical capabilities. Critical infrastructure operators in the energy, water, and related industrial sectors who received the CISA advisory about CyberAv3ngers' 2023 PLC attacks should treat GigaWiper as a capability evolution by the same actor group.
The 2023 CyberAv3ngers campaigns were relatively unsophisticated in technique: they exploited default credentials on internet-facing Unitronics PLCs, a technique that does not require significant malware development capability. GigaWiper is a qualitatively different capability: a purpose-built Go backdoor with espionage functionality, sophisticated C2 architecture using legitimate enterprise services, and multiple destruction mechanisms. The gap between those two capability points represents significant investment in offensive tooling by the group or their sponsors.
For critical infrastructure security teams, the detection of GigaWiper's C2 indicators in network logs, or the detection of its persistence mechanisms on endpoints, should be treated as a potential precursor to a destructive operation rather than as a standalone malware incident. The espionage phase that precedes the destructive trigger, including the extensive VNC and screen capture capabilities, is designed to provide the operator with the intelligence needed to choose the moment of maximum destructive impact. A GigaWiper implant that has been active in an environment for weeks is an implant that has potentially already provided that intelligence to the operator, and the destructive trigger may be near.
The decision to route GigaWiper's command-and-control traffic through RabbitMQ (AMQP protocol), Redis, and MinIO (S3 API) is a specific countermeasure against the network-based detection and blocking controls that most enterprise environments deploy. Organisations that use these technologies legitimately cannot block the protocols without disrupting legitimate operations. Organisations that do not use these technologies might be able to block them, but doing so requires identifying that the traffic is using those specific protocols rather than generic encrypted connections, which demands deep packet inspection or protocol-aware filtering.
The most actionable network-based defence is to block the specific C2 IP addresses (185.182.193[.]21 and 212.8.248[.]104) at the perimeter, which eliminates the known current infrastructure without requiring protocol-level blocking. Monitoring for new AMQP, Redis, or S3-protocol connections to external IP addresses that are not part of the organisation's approved cloud vendor list is the next layer: it catches C2 infrastructure that the operators have moved to new IP addresses after the known addresses become widely blocked. Combining the IP blocklist with behavioural monitoring for RabbitMQ, Redis, and MinIO protocol traffic to unexpected external destinations gives a two-layer detection approach that remains effective even after the operators rotate their C2 infrastructure.
Long-undetected kernel flaws, forced infrastructure shutdowns, AI agent attack chains, and destructive backdoors masquerading as ransomware represent distinct threat categories with a shared characteristic: your team needs signal before the attack reaches its final stage. Defendis monitors the external exposure your organisation presents, credential leaks tied to your domain, and threat actor activity targeting your sector and infrastructure. When a vulnerability in the software your organisation runs starts drawing exploitation interest, or when indicators tied to a threat group like CyberAv3ngers appear in your environment, you get the alert before it becomes a crisis. See how continuous exposure monitoring changes response outcomes, or request a tailored briefing for your organisation.
