Google Threat Intelligence tracks new modular GigaWiper malware

Google’s Threat Intelligence Group is now tracking the modular GigaWiper malware, a backdoor that lets attackers choose between disk wiping, fake ransomware or system sabotage after gaining network access【2】. The move signals heightened scrutiny of sophisticated wiper tools that can evade traditional defenses.

At a glance

Modular design expands attacker options

GigaWiper combines multiple malware families into a single implant, offering roughly 20 command‑and‑control functions such as remote shell, file management and hidden remote desktop sessions【2】. Unlike traditional wipers that execute a single destructive payload, GigaWiper lets operators delay or forego destruction, deploying additional tools first. Microsoft’s threat intel notes three distinct destructive modules: a raw disk overwriter, a fake ransomware that discards encryption keys, and a multi‑pass wiper that repeatedly overwrites files【2】. This flexibility marks a shift from “fire‑and‑forget” attacks to a more controlled, multi‑stage approach.

Industry response and mitigation guidance

Security experts warn that the modularity of GigaWiper complicates detection. Researchers recommend monitoring for RabbitMQ and Redis traffic on non‑standard ports, as the backdoor uses these protocols for command delivery—a pattern uncommon in typical enterprise networks【2】. Microsoft also advises enabling tenant‑wide tamper protection, disabling local admin merges, and blocking known C2 infrastructure to reduce exposure【2】. The involvement of Google’s Threat Intelligence Group underscores the broader industry effort to map and contain such evolving threats.

What to watch

• Further attribution – Whether Google or other agencies can link GigaWiper to specific nation‑state actors.
• Detection signatures – Development of IDS/IPS signatures for RabbitMQ/Redis anomalies tied to GigaWiper.
• Potential variants – Emergence of new modular wipers that build on GigaWiper’s architecture.

The tracking of GigaWiper by Google highlights the growing complexity of wiper malware, where attackers can tailor destruction to their objectives, challenging defenders to adapt detection and response strategies.