GigaWiper (aka BLUERABBIT): Golang-Based Destructive Backdoor Combining Wiper, Fake Ransomware, and C2 Capabilities — Threadlinqs Intelligence
As of 2026-07-10, GigaWiper (aka BLUERABBIT): Golang-Based Destructive Backdoor Combining Wiper, Fake Ransomware, and C2 Capabilities is a critical-severity malware threat attributed to Cyber Av3ngers (Iran), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-1158 · Severity: CRITICAL · Status: ACTIVE · Category: MALWARE
Attribution: Cyber Av3ngers · Iran · DESTRUCTION
Microsoft identified GigaWiper, a Golang-based backdoor that unifies command-and-control with multiple destructive payloads — physical disk wiping, non-recoverable AES-256-CBC file encryption (fake
GigaWiper is a Golang-compiled backdoor first observed conducting destructive activity in October 2025 and publicly documented by Microsoft Threat Intelligence on 2026-07-09 (independently tracked as BLUERABBIT by Binary Defense since March 2026). The malware receives tasking over RabbitMQ (AMQP, port 5544) using a fanout exchange named "All" for broadcast commands and a topic exchange for targeted tasking, reports status/output via Redis (port 7542), and can exfiltrate files to attacker-controlled MinIO object storage — all legitimate open-source message-broker/storage technologies repurposed as camouflaged C2 transport. Hard-coded C2 credentials and configuration are protected with AES decryption.
The backdoor exposes 20 numbered command codes to the operator, ranging from routine RAT functionality (PowerShell execution with directory persistence, process/service/registry management, system and security-software enumeration, idle-aware screenshot/screen-recording capture, VNC-like remote desktop control via Command 20, Windows event log clearing across System/Setup/Application/Security/ForwardedEvents channels, and firewall rule manipulation) to three distinct destructive payloads that were previously separate malware families: Command 1 (WipeMain) performs physical-disk-level wiping via DeviceIoControl with IOCTL_DISK_CREATE_DISK, overwriting raw disk content in 0xA00000-byte chunks; Command 2 disables Windows Recovery and deletes critical boot/kernel files to force a BSOD/unbootable state; Command 3 (BigBangExtortMain) is fake ransomware — AES-256-CBC encryption with randomly generated, never-persisted keys/IVs, appending a `.candy` extension and dropping a hard-coded wallpaper (`./image_danger.jpg`) — code Microsoft found 'heavily based on' Crucio ransomware, sharing the identical BigBangExtortMain function name; and Command 12 (WipeCMain) is a Golang re-implementation of FlockWiper, a standalone C-language multi-pass wiper first uploaded to VirusTotal in June 2025, targeting only the Windows installation drive with multiple secure overwrite passes.
Microsoft ties all three malware families (GigaWiper, Crucio, FlockWiper) to a single developer based on PDB-path and function-naming overlap referencing the string "GRAT" in both FlockWiper and GigaWiper, suggesting the possible existence of a related, still-undocumented "GRAT" framework component. Crucio ransomware was previously documented by CISA in December 2023 in connection with IRGC-affiliated cyber actors (the CyberAv3ngers persona) that exploited internet-exposed Unitronics Vision-series PLCs at U.S. water/wastewater facilities; subsequent open-source reporting (Binary Defense / Google Threat Intelligence Group) assesses the same Iran-nexus actor conducted destructive GigaWiper/BLUERABBIT operations primarily against Israeli organizations, consistent with the CyberAv3ngers group's broader pattern of destructive operations against US, Israeli, UK, and Irish water and energy-sector targets from 2023-2026. Persistence is achieved via a scheduled task named "OneDrive Update" that runs at system startup and every minute thereafter, invoking PowerShell with hidden-window execution parameters and tracked via a benign-looking registry key (HKCU\SOFTWARE\OneDrive\Environment). Defense evasion includes masquerading a firewall rule as the legitimate Windows component "Microsoft.Windows.CloudExperienceHost" and direct deletion of Windows Security event log files. Dormant/unused code paths include keylogger stubs and additional wiper-module scaffolding not yet activated in observed samples, indicating the framework is under active development.
Target sectors: government administration, energy, waterandwastewater, criticalinfrastructure
Target regions: israel, united states of america, united kingdom, ireland
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, CRITICAL, threat intelligence, cybersecurity, T1053, T1547, T1059, T1070, T1112, T1036, T1685, T1140, T1082, T1057
