Microsoft Warns of GigaWiper Malware

Microsoft has identified a new piece of malware known as GigaWiper. This malware can not only spy on data but also render entire systems unusable. Researchers from Microsoft Threat Intelligence detected the activities as early as October 2025, when the first attacks were observed in compromised environments. GigaWiper combines several destructive functions and provides attackers with a powerful backdoor. The malware is not limited to deleting files but overwrites hard drives at a low level.

This results in irretrievable destruction of data, as it directly accesses the physical drives and removes partition entries. Another dangerous feature of GigaWiper is its ability to overwrite the Windows system drive multiple times with different data patterns. This technique significantly complicates data recovery. After the destruction actions are completed, the computer is restarted, making the stored data no longer normally accessible. Additionally, GigaWiper disguises itself as ransomware by encrypting files with the extension “.candy”.

In contrast to conventional ransomware attacks, however, the keys used are generated randomly and not stored, making later decryption impossible. The malware also offers attackers the ability to gather extensive information about the infected systems. GigaWiper can take screenshots, record the screen, and collect system information. These features allow attackers to take control of a system before activating the destructive functions. To secure its presence on affected computers, GigaWiper sets up a scheduled task in the Windows Task Scheduler named “OneDrive Update”.

This task runs regularly to keep the malware active. For communication with command servers, GigaWiper utilizes technologies such as RabbitMQ and Redis. Microsoft researchers warn that GigaWiper poses a serious threat to businesses and individuals. The malware is capable of not only deleting data but also impairing the entire functionality of a system. The combination of destruction and information gathering makes GigaWiper a multifunctional threat.

Microsoft has published an analysis of the malware to inform the public about the dangers. The researchers recommend regularly backing up systems and promptly installing security updates to protect against such threats. The exact spread of GigaWiper is currently unclear; however, the malware is being actively monitored. The vulnerability CVE-2025-XXXX, associated with GigaWiper, affects several versions of Windows and could potentially endanger millions of users. Microsoft plans to provide further information and protective measures in the coming weeks.