GigaWiper malware surfaces on Windows PCs: it can spy and wipe

Microsoft first spotted GigaWiper in October 2025. It’s a Windows malware strain that blends remote-access Trojan behavior with disk-wiping attacks.

Malwarebytes Anti-Malware Download

Binary Defense took a closer look in March 2026 and analyzed the same malware under the name BLUERABBIT. Its researchers say GigaWiper is modular and stitched together from at least three older malware families, with code tied to Crucio ransomware and FlockWiper, which leaves one infection able to do two jobs at once: watch what’s happening on a system, then wreck it.

Binary Defense says GigaWiper can overwrite an entire physical drive, run a multi-pass wipe on the Windows drive, or pretend to be ransomware by encrypting files with a key that’s never saved. That kind of misdirection showed up in attacks like NotPetya, where victims could be led to believe recovery was still on the table when it wasn’t.

If you’re responsible for protecting businesses, government bodies, or critical infrastructure, pay attention to this one. Binary Defense links GigaWiper to an Iran-linked actor also associated with BLUEWIPE and SEWERGOO, known for targeting organizations in Israel, and the all-in-one design gives attackers a way to hold back obvious warning signs until later in the intrusion.

The malware goes after Windows systems and falls into the same geopolitically charged wiper pattern seen in the 2026 Stryker attack, which reports say wiped more than 80,000 devices across 79 countries, and in the late-2025 DynoWiper attempt against Poland’s energy sector.