GigaWiper: Modular Windows Backdoor with Data Wiper and C2 Capabilities Analysis

Vulnerability Overview Vulnerability Name: GigaWiper Description: GigaWiper is a modular backdoor designed for Windows systems capable of permanently destroying systems and data. It combines Command and Control (C2) functionalities and masquerades as ransomware; however, instead of merely extorting victims, it encrypts files and subsequently deletes the encryption keys, rendering recovery impossible. Key Features: - Windows Drive Secure Erasure: Performs multiple overwrites on the Windows installation drive, making data unrecoverable. - Screen Capture and Recording: Captures single-frame screenshots of each monitor and performs continuous recording. - Remote Control: Streams the desktop via a TCP server, allows keyboard and mouse input, and creates its own Windows firewall exceptions. - Scheduled Tasks: Establishes a scheduled task named "OneDrive Update" that runs every minute and persists upon system startup. Scope of Impact Target Systems: Windows systems Attack Vector: Deployed following initial compromise, allowing attackers to execute destructive commands. Detection Names: Malwarebytes detects GigaWiper components as Trojan.FlockWiper and Backdoor.GigaWiper. Remediation Preventive Measures: - If GigaWiper is detected, immediately disconnect the affected machine from the network to prevent attackers from executing destructive commands. - Enable anti-tampering protection (or equivalent functionality in security software) to prevent local administrators and malware from disabling antivirus or other security tools. - Monitor for connections to known C2 servers, the creation of the "OneDrive Update" scheduled task, and attempts to disable Windows recovery options. - Rotate credentials, especially for accounts suspected of being compromised, and review logs to determine if other systems have been affected. Detection and Removal: - Malwarebytes can detect and remove GigaWiper components. POC Code or Exploit Code No specific POC code or exploit code is provided on the page. Additional Information Command and Control Servers: The identified C2 server IP addresses are 185.182.193.[.]21 and 212.8.248.[.]104. Related Articles: - 69 Million Driver License Numbers Stolen from AssuranceAmerica - Microsoft Patches RoguePlanet Zero-Day Vulnerability - Your Next Car Might Be Watching Your Face Summary GigaWiper is a highly dangerous Windows backdoor capable of permanently destroying systems and data. Users are advised to implement the aforementioned preventive measures and utilize security tools such as Malwarebytes for detection and removal.

Goal Reached Thanks to every supporter — we hit 100%!

GigaWiper: Modular Windows Backdoor with Data Wiper and C2 Capabilities Analysis

More from this source