GigaWiper (BLUERABBIT) — Go-Based Modular Backdoor Bundles Raw Disk Wiper, Crucio-Derived Fake Ransomware, and FlockWiper Drive Overwriter Behind Espionage Tooling — Threadlinqs Intelligence
As of 2026-07-09, GigaWiper (BLUERABBIT) — Go-Based Modular Backdoor Bundles Raw Disk Wiper, Crucio-Derived Fake Ransomware, and FlockWiper Drive Overwriter Behind Espionage Tooling is a high-severity malware threat attributed to Suspected Iran-nexus (Iran), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 40 indicators of compromise.
Threat ID: TL-2026-1147 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Suspected Iran-nexus · Iran · DESTRUCTION
GigaWiper, tracked by Microsoft and also identified as BLUERABBIT by Binary Defense (via Google Threat Intelligence Group), is a Go-based Windows backdoor that consolidates a raw-disk wiper, a
GigaWiper/BLUERABBIT is a modular, Go-language Windows backdoor first identified by Microsoft (destructive activity dated October 2025) and independently reported by Binary Defense as BLUERABBIT (first observed mid-to-late March 2026), citing Google Threat Intelligence Group (GTIG) report 26-10016354 and linking it to the same Iran-nexus activity cluster that previously deployed BLUEWIPE and SEWERGOO in June 2025.
The malware's defining characteristic is command-driven modularity: a single backdoor exposes numbered commands that let the operator choose the outcome of a compromise after the fact rather than committing to a payload at build time. Command 1 (WipeMain) performs raw physical-disk wiping via WMI enumeration and IOCTL_DISK_CREATE_DISK partition-table destruction followed by sequential randomized-buffer overwrite. Command 2 (BSOD) disables Windows recovery mechanisms via registry modification (CrashControl AutoReboot, WindowsUpdate AU NoAutoRebootWithLoggedOnUsers, Maintenance MaintenanceDisabled), takes ownership of boot-critical files (bootmgr, ntoskrnl.exe, winload) via takeown/icacls, and deletes them to force an unbootable state. Command 3 (RanMain / BigBangExtortMain) is a fake-ransomware routine derived from the Crucio codebase — files are AES-CBC encrypted in chunks with unsaved, randomly generated keys (no decryption is possible even if a ransom were paid), renamed with a .candy extension, and the desktop wallpaper is replaced with an AI-generated extortion image; this function shares code lineage with Crucio ransomware referenced in the December 2023 CISA/NSA/EPA/FBI/INCD joint advisory AA23-335A on IRGC-affiliated ('CyberAv3ngers') actors exploiting Unitronics Vision-series PLCs at US and international water/wastewater facilities. Command 12 (WipeCMain) is a multi-pass secure wipe of the Windows installation drive only, reimplementing the C-based FlockWiper tool (first seen on VirusTotal June 2025) in Go; PDB debug paths in FlockWiper and function names inside GigaWiper both contain a recurring 'GRAT' string suggesting a shared development framework or toolkit lineage across the malware families.
Beyond destructive capability, GigaWiper carries a full espionage/RAT suite: all-monitor screenshot capture, screen recording during active user sessions, hidden VNC for live desktop viewing and remote keyboard/mouse control, shell command execution, system/hardware/network/domain profiling, security-product and BitLocker-status detection, process and service enumeration/management, registry editing, Windows event-log wiping, and dormant keylogger stubs.
Command and control is unusually implemented atop legitimate, widely-deployed backend services rather than bespoke protocols: RabbitMQ over AMQP serves as the primary tasking channel (a device-named queue with the consumer tag set to the malware's own executable path; tasks delivered as JSON via a fanout 'All' exchange for broadcast operations and a 'Topic' exchange for routing-key-targeted deployment to specific victims), Redis (RESP protocol) handles state tracking and result/status reporting, and a MinIO S3-compatible object store is used for staging and exfiltrating large files — data is first written to GUID-named staging directories (a detection opportunity, since the malware's GUID generator uses the full A–Z/0–9 alphanumeric range rather than the hexadecimal-only characters used by legitimate Windows GUIDs) before upload via the MinIO client (mc), frequently invoked with the --insecure flag.
Persistence and masquerade center on impersonating Microsoft OneDrive: on first execution the malware checks/writes HKCU\SOFTWARE\OneDrive\Environment to track execution count, then establishes a scheduled task named 'OneDrive Update' via PowerShell/New-ScheduledTaskAction with a five-second initial delay and 60-second repeat interval, a startup trigger, AllowStartIfOnBatteries, hidden execution, automatic restart (up to three attempts), no execution time limit, and
Target sectors: government administration, informationtechnology, criticalinfrastructure, waterandwastewater, energy
Target regions: israel, united states of america, united kingdom, ireland
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 40 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1053, T1547, T1112, T1036, T1562, T1222, T1070, T1082, T1518, T1057