GigaWiper Lets Threat Actors Choose Their Own Destructive Attack
GigaWiper is a novel, modular malware that combines backdoor and wiper capabilities, allowing attackers to choose how to destroy a targeted system while minimizing their operational footprint. Initially identified as a Golang-based backdoor, researchers later determined it integrates multiple malware families, including a raw disk wiper, a fake ransomware derived from Crucio, and a multipass secure wiper based on FlockWiper. The malware utilizes RabbitMQ and Redis for command and control, and is being tracked by Google Threat Intelligence Group as BlueRabbit, with attribution to an Iran-based threat actor. Microsoft recommends proactive hunting for pre-destruction activity and implementing several hardening measures, including blocking nonstandard RabbitMQ/Redis traffic and enabling tenant-wide tamper protection.
GigaWiper is a new modular malware that combines backdoor and wiper functionalities, giving attackers significant flexibility in how they can compromise and destroy a system. Initially identified as a Golang-based backdoor, researchers later discovered it integrates multiple malware families, including a raw disk wiper that overwrites physical disks, a fake ransomware derived from the Crucio ransomware family that encrypts files with random keys, and a multipass secure wiper based on FlockWiper. The malware leverages RabbitMQ, an Advanced Message Queuing Protocol (AMQP) implementation, and Redis server for command and control, moving away from typical HTTP/DNS communication. Google Threat Intelligence Group is also tracking GigaWiper under the name BlueRabbit, and a previous report from Binary Defense has also observed BlueRabbit, attributing it to an Iran-based threat actor.
“GigaWiper [is] a versatile implant that combines robust command-and-control (C2) capabilities with multiple destructive payloads, including disk wiping, fake ransomware, and system-level sabotage,” according to a recent Microsoft Threat Intelligence (MTI) blog post. The malware’s ability to destroy systems isn’t the only modular functionality; the back-end C2 infrastructure also demonstrates modularity, utilizing RabbitMQ and Redis instead of relying primarily on HTTP or DNS communications.
Microsoft recommends several mitigation steps to defend against GigaWiper and similar wiper attacks. These include:
- Hunt for the pre-destruction phase, looking for RabbitMQ and Redis traffic on nonstandard ports.
- Implement tenant-wide tamper protection features to prevent attackers from stopping security services or using antivirus exclusions.
- Enable DisableLocalAdminMerge on Intune or Microsoft Defender for Endpoint Security Configuration to prevent modification of antivirus exclusions via Group Policy Objects (GPO).
- Block direct access to known C2 infrastructure.
- Turn on cloud-delivered protection in AV products.
- Block executable files unless they meet a prevalence, age, or trusted list criterion.
Threat actors have recently used wipers to target Venezuelan energy firms and Russian threat actors have extensively used wipers against Ukrainian targets during the ongoing war. Wipers are particularly concerning due to their potential to target critical infrastructure, especially in times of conflict. The evolution of wiper malware, as seen with GigaWiper, reflects a shift towards more sophisticated and adaptable attack techniques.