GigaWiper can wipe drives and spy on PCs

Microsoft has published an analysis of GigaWiper, a multi-faceted piece of malware assembled from several families that can overwrite raw disk content and remove partition metadata at the physical disk level. Its destructive tools include a Windows drive secure wiper that performs multiple overwrites with different byte patterns, and a routine that identifies physical drives, confirms which contains Windows, strips partition references from other drives, overwrites raw disk content with randomized data and reboots the system.

Another component, based on Crucio, mimics ransomware by encrypting files and then discarding the encryption key instead of demanding payment. Alongside data destruction, GigaWiper can capture and stream the desktop, allow remote control via an external TCP server, and conceal itself as a scheduled OneDrive task.

The malware appears aimed at organisations and requires a prior breach to operate, so keeping security software updated should protect most home users.

gigawiper, malware, disk wiper, drive overwrite, partition metadata, crucio, ransomware, desktop streaming, remote control, onedrive task