A new strain of malware dubbed GigaWiper has emerged, capable of both irreversibly wiping PC storage drives and spying on user desktops. Microsoft's analysis reveals GigaWiper as a sophisticated threat, appearing to be a combination of multiple malware families.
GigaWiper employs several methods to destroy data at the physical disk level. One technique involves a secure wiper for Windows installations that performs multiple overwrites with varying byte patterns, rendering data recovery practically impossible. Another method identifies physical drives, targets the Windows installation drive, removes partition metadata from other drives, overwrites their raw content with random data, and then reboots the system.
A variant based on the Crucio wiper mimics ransomware by encrypting files but then discards the encryption key, thus making the data irrecoverable without any possibility of ransom. Beyond its data destruction capabilities, GigaWiper can also capture screenshots, stream desktop content, and allow remote control of the affected machine through an external TCP server. It achieves this stealthily by disguising its operations as a scheduled OneDrive task.
While GigaWiper's all-in-one approach is concerning, it appears to be primarily targeted towards organizations rather than individual home users. Its operation requires an initial breach of a PC to deploy. For most home users, maintaining updated security software is expected to provide sufficient protection. However, system administrators are advised by Microsoft to implement multiple network hardening measures, including tenant-wide tamper protection, to prevent breaches and stop the malware before it can spread through IT infrastructure. This new threat serves as a further reminder for organizations to thoroughly review their security practices.