Threat Summary
The pulse describes GigaWiper, a Golang-based backdoor reported by Microsoft Threat Intelligence after an October 2025 discovery and indexed by AlienVault OTX on 2026-08-09. The implant is assessed as a multi-stage intrusion toolkit that merges backdoor tasking with destructive payload delivery. Its malware set spans GigaWiper plus related components named Crucio, FlockWiper, WprFlock, WprCree and CutBrooch. The reported design points to an operator able to run command-and-control, stage destructive modules, and present activity as ransomware while likely pursuing disruption, extortion theater, or anti-forensic damage rather than classic encryption-only monetization. Enterprise impact is highest for Windows server fleets, virtualization hosts, build systems and data platforms where physical-disk writes or brokered messaging traffic would be anomalous.
Threat Actor / Malware Profile
Attribution is listed as Unknown; defenders should treat this as capability-driven intelligence rather than actor-name-driven. Distribution is not fully enumerated in the pulse, but a Golang implant with modular destructive payloads is consistent with loader-driven intrusion, exposed service exploitation, stolen credential lateral movement, or post-access deployment after an initial foothold. Payload behavior centers on a backdoor that can coordinate multiple destructive components: a standalone physical-disk-level wiper, a Crucio-ransomware-derived destructive component, and supporting modules tracked as FlockWiper, WprFlock, WprCree and CutBrooch. Tags explicitly reference fake ransomware and RabbitMQ, making AMQP/AMQPS ports 5672 and 5671 high-value C2 or tasking pivots, especially from non-broker servers. Persistence should be hunted through Run keys, services, scheduled tasks, WMI subscriptions and image-file execution options because modular Golang malware commonly relies on LOLBins and service control for survivability. Anti-analysis expectations include packed Go binaries, large static binaries, string obfuscation, delayed execution, environment checks, timestomping, log deletion and destructive actions intended to break IR workflows.
IOC Analysis
The provided indicators are file hashes only: three SHA256 values and five MD5 values in the visible sample, with 18 total indicators in the pulse. Hashes are brittle but immediately useful for blocking, retro-hunting EDR process launches, and triage of quarantine, backup, email gateway, proxy download and software-distribution logs. Prioritize SHA256 over MD5 for authoritative matching; use MD5 for legacy tooling correlation only. Enrich hashes with file path, signer, parent process, command line, service name, scheduled task, first-seen host, and network destination before mass deletion because destructive malware may be staged under benign-looking names. Tooling: send hashes to EDR blocklists, SIEM watchlists, MISP/ThreatConnect, YARA/PEStudio for triage, VirusTotal/OTX for enrichment, and Velociraptor/osquery for fleet sweeps. Network analytics should flag AMQP from endpoints, unusual TLS to 5671, and raw disk handle access preceding mass file changes.
Detection Engineering
---
title: Suspicious Raw Physical Disk Access Command Line
id: 9f1a2b3c-gigawiper-0001-0001-000000000001
status: experimental
description: Detects process command lines referencing raw physical disk paths or wiper-style names associated with the GigaWiper pulse.
date: 2026/08/09
modified: 2026/08/09
author: Security Arsenal
logsource:
category: process_creation
product: windows
level: high
detection:
sel_img:
CommandLine|contains:
- '\\.\PhysicalDrive'
- '\\.\GLOBALROOT'
- 'wprcree'
- 'wprflock'
- 'flockwiper'
- 'cutbrooch'
- 'gigawiper'
- 'crucio'
condition: sel_img
falsepositives:
- backup software
- disk imaging
- enterprise forensic acquisition
---
title: Endpoint AMQP RabbitMQ-Style C2 From Non-Broker Host
id: 9f1a2b3c-gigawiper-0002-0002-000000000002
status: experimental
description: Flags network connections to common RabbitMQ AMQP ports from processes unlikely to be enterprise messaging clients.
date: 2026/08/09
modified: 2026/08/09
author: Security Arsenal
logsource:
category: network_connection
product: windows
level: medium
detection:
sel_port:
DestinationPort:
- 5671
- 5672
suspicious_parent_or_image:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\svchost.exe'
condition: sel_port and suspicious_parent_or_image
falsepositives:
- application servers
- CI agents
- message-queue clients
---
title: Destructive Fake Ransomware Precursor Behaviors
id: 9f1a2b3c-gigawiper-0003-0003-000000000003
status: experimental
description: Correlates vssadmin deletion, boot status changes, service control and mass rename notes often seen before fake-ransomware or wiper detonation.
date: 2026/08/09
modified: 2026/08/09
author: Security Arsenal
logsource:
category: process_creation
product: windows
level: critical
detection:
sel_shadow:
CommandLine|contains|all:
- 'vssadmin'
- 'delete'
- 'shadows'
sel_boot:
CommandLine|contains|all:
- 'bcdedit'
- 'recoveryenabled'
sel_note:
CommandLine|contains:
- 'README'
- 'DECRYPT'
- 'unlock'
- 'recover files'
condition: 1 of sel_*
falsepositives:
- admin maintenance
- legitimate backup pruning
let Hashes = dynamic(["440b5385d3838e3f6bc21220caa83b65cd5f3618daea676f271c3671650ce9a3","12c39f052f030a77c0cd531df86ad3477f46d1287b8b98b625d1dcf89385d721","db41e0da7ab3305be8d9720769c6950b4dc1c1984ef857d3310eb873a0fc7674","a9dbe0025975e3fa764376a437043963","be1082aac756fbf3ad7f41c1bc5b9eec","62bcb76113ea745020f5e68c8ce9f283","fbc2f83b75f3602a281fec095068ea34","7c76e51390b0d2e2759fad5ccee2bc30"]);
union withsource=T (DeviceProcessEvents, DeviceNetworkEvents, DeviceFileEvents)
| where Timestamp > ago(14d)
| extend Hit = case(SHA256 in (Hashes), "sha256", MD5 in (Hashes), "md5", ProcessCommandLine has_any ("gigawiper","crucio","flockwiper","wprflock","wprcree","cutbrooch","PhysicalDrive"), "behavior", RemotePort in (5671,5672), "amqp", "")
| where Hit != ""
| project Timestamp, T, DeviceName, ActionType, FileName, FolderPath, SHA256, MD5, ProcessCommandLine, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, Hit
| order by Timestamp desc;
$ErrorActionPreference='SilentlyContinue'
$sha='440b5385d3838e3f6bc21220caa83b65cd5f3618daea676f271c3671650ce9a3','12c39f052f030a77c0cd531df86ad3477f46d1287b8b98b625d1dcf89385d721','db41e0da7ab3305be8d9720769c6950b4dc1c1984ef857d3310eb873a0fc7674'
$md5='a9dbe0025975e3fa764376a437043963','be1082aac756fbf3ad7f41c1bc5b9eec','62bcb76113ea745020f5e68c8ce9f283','fbc2f83b75f3602a281fec095068ea34','7c76e51390b0d2e2759fad5ccee2bc30'
$roots=@($env:TEMP,$env:APPDATA,$env:ProgramData,'C:\Users\Public','C:\Windows\Temp')
foreach($r in $roots){ Get-ChildItem $r -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object { $h=Get-FileHash $_.FullName -Algorithm SHA256; if($sha -contains $h.Hash){[pscustomobject]@{Type='SHA256';Path=$_.FullName;Hash=$h.Hash}}; $m=Get-FileHash $_.FullName -Algorithm MD5; if($md5 -contains $m.Hash){[pscustomobject]@{Type='MD5';Path=$_.FullName;Hash=$m.Hash}} } }
Get-NetTCPConnection -State Established | Where-Object {$_.RemotePort -in 5671,5672} | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,OwningProcess,@{n='Process';e={(Get-Process -Id $_.OwningProcess).ProcessName}}
Get-ScheduledTask | Where-Object {$_.TaskName -match 'giga|crucio|flock|wpr|cutbrooch|update|sync'}
Get-CimInstance Win32_Service | Where-Object {$_.Name -match 'giga|crucio|flock|wpr|cutbrooch' -or $_.PathName -match 'giga|crucio|flock|wpr|cutbrooch'} | Select-Object Name,State,PathName
'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\Run' | ForEach-Object { Get-ItemProperty $_ | ForEach-Object { $_.PSObject.Properties | Where-Object {$_.Value -match 'giga|crucio|flock|wpr|cutbrooch|PhysicalDrive'} } }
wevtutil qe Security /q:"*[System[(EventID=1102)]]" /f:text /c:5
Response Priorities
- Immediate: push SHA256/MD5 to EDR, proxy, email and application-control blocklists; isolate hosts with raw PhysicalDrive command lines, AMQP egress from non-broker processes, shadow deletion, boot recovery tampering, or mass file rename/write bursts. Capture memory before reboot because destructive modules may be staged to trigger at restart.
- 24h: if any credential access, LSASS tampering, suspicious RDP/VPN logons, or new local/admin accounts are found on affected hosts, force enterprise credential resets, revoke tokens and sessions, and validate MFA. Even though this pulse emphasizes destruction over theft, backdoor tasking plus fake ransomware often rides on valid accounts.
- 1 week: harden architecture by restricting AMQP egress to approved brokers, blocking raw disk access for non-forensic tools, enforcing application control for unsigned Go binaries, enabling tamper protection and cloud-delivered blocking, separating backup control planes, testing immutable restore, and adding detections for vssadmin/bcdedit/service-control chains tied to EDR auto-isolation.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.