Date: 07/13/2026
Severity: High
Summary
GigaWiper is a sophisticated Golang-based backdoor that combines advanced command-and-control capabilities with multiple destructive functions, including disk wiping, fake ransomware, and system sabotage. The malware integrates features from several destructive malware families, enabling threat actors to selectively deploy payloads through a single modular platform. This unified design increases operational flexibility while expanding the malware’s destructive impact and reducing its deployment footprint.
Indicators of Compromise (IOC) List
IP Address | 185.182.193.21 212.8.248.104 |
Hash | 633d4cbd496b1094495da89a64f5e6c31a0f6d4d1488411db5b0cba1cfe42001
ce9ad5f6c12019f4aae5b189bd8ddf5bb09e75b06a0a587b25a855c65948c913
f622ed85ef31ad4ab973f4e74524866fe1bb44f0965ad2b2ad796cd657a05bfd
9706a192e2c1a1faaf0a521daf31c2af60ff4590e3f47bbb4abc227f42af0683
3c30deb6556a94cfb84ae51798f4aecfae8c7358e55fdb321c5f2376579631cd
440b5385d3838e3f6bc21220caa83b65cd5f3618daea676f271c3671650ce9a3
12c39f052f030a77c0cd531df86ad3477f46d1287b8b98b625d1dcf89385d721
db41e0da7ab3305be8d9720769c6950b4dc1c1984ef857d3310eb873a0fc7674
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | dstipaddress IN ("185.182.193.21","212.8.248.104") or srcipaddress IN ("185.182.193.21","212.8.248.104") |
Detection Query 2 : | sha256hash IN ("db41e0da7ab3305be8d9720769c6950b4dc1c1984ef857d3310eb873a0fc7674","ce9ad5f6c12019f4aae5b189bd8ddf5bb09e75b06a0a587b25a855c65948c913","3c30deb6556a94cfb84ae51798f4aecfae8c7358e55fdb321c5f2376579631cd","f622ed85ef31ad4ab973f4e74524866fe1bb44f0965ad2b2ad796cd657a05bfd","440b5385d3838e3f6bc21220caa83b65cd5f3618daea676f271c3671650ce9a3","633d4cbd496b1094495da89a64f5e6c31a0f6d4d1488411db5b0cba1cfe42001","9706a192e2c1a1faaf0a521daf31c2af60ff4590e3f47bbb4abc227f42af0683","12c39f052f030a77c0cd531df86ad3477f46d1287b8b98b625d1dcf89385d721")
|
Reference:
https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/#indicators-of-compromise