Analysis of GigaWiper: A Multi-Function Windows Backdoor Combining Disk Wiping, Fake Ransomware, and Spyware

GigaWiper is a Windows backdoor combining disk wiping, fake ransomware, and spyware capabilities, developed by an Iran-nexus group targeting Israeli organizations. It employs legitimate services for command-and-control and evades detection by mimicking legitimate processes.

Microsoft has taken apart a destructive Windows backdoor it calls GigaWiper. What stands out is how it is built: not one tool but three older destructive programs bolted into one, offered as commands the operator can choose from.

Each is a different way to break a machine: wipe the whole disk, overwrite the Windows drive, or run fake "ransomware" that scrambles files with a key it never saves

Read original article