This new Windows malware can take over your PC and wipe it clean

Strategic summary

The research report describes 'GigaWiper', a modular Windows backdoor written in Golang that combines remote access, espionage, and multiple data destruction methods. The malware leverages components from earlier tools like Crucio ransomware and FlockWiper, and can, among other things, overwrite raw disks, irreversibly encrypt files, and record the desktop. It establishes persistence via a scheduled task named 'OneDrive Update'. The best defense is preventing initial compromise and detecting malicious activity early.

Key findings

• GigaWiper is a modular backdoor with approximately 20 commands, including functions for data destruction, remote monitoring, and system manipulation.
• The malware disguises data destruction as ransomware (Crucio), but discards the key, making recovery impossible.
• For persistence, GigaWiper creates a scheduled task 'OneDrive Update' that runs every minute and at startup.
• The command-and-control servers were identified at IPs 185.182.193.21 and 212.8.248.104.
• Prevention requires blocking the initial intrusion and monitoring for suspicious tasks and network connections.