In late 2025, Microsoft's threat intelligence teams detected a new strain of malware that quickly emerged as one of the most dangerous in recent years: GigaWiper, also known as BlueRabbit. It is a hybrid threat that fuses irreversible erasure techniques with remote access capabilities, changing the rules of the game in the enterprise cybersecurity landscape. Unlike a common wiper that simply deletes files, GigaWiper directly accesses the storage hardware using low-level commands. It overwrites boot sectors and partition tables with random data, and then makes several passes over the contents of the disk with specific patterns, following military secure erase techniques. The result is that, even with advanced forensic tools, data recovery is impossible.
In addition, the malware includes a module that encrypts files and appends the .candy extension to them. However, this is not traditional ransomware: the encryption keys are randomly generated and are never stored or sent to the attackers. Therefore, there is no possibility of payment or recovery. This behavior suggests that the main objective is not economic extortion, but the total destruction of information. But GigaWiper doesn't just destroy. It acts as a sophisticated backdoor that allows attackers to take complete control of the system. They can capture the screen in real-time, log keystrokes, run remote processes, modify registry keys, and delete event logs to erase any traces of their presence. This pre-spying capability allows attackers to select the most critical systems before activating the destructive phase.
To ensure its permanence, GigaWiper installs itself as a scheduled task under the misleading name "OneDrive Update". In addition, it uses legitimate protocols and services such as RabbitMQ and Redis to communicate with command and control servers, camouflaging malicious traffic among normal company traffic. According to analyses, this threat mainly targets organizations and large companies. Mass distribution to home users has not been detected, but any system exposed to targeted attacks can be vulnerable. The gateway is usually through phishing, exploiting vulnerabilities or initial access to the corporate network.
Defending against GigaWiper requires a comprehensive strategy. Enterprises must implement intrusion detection systems, enable tamper protection in security software, and monitor suspicious scheduled tasks. Offline backups are a must, as wipers can destroy any connected copies. In this scenario, having professional cybersecurity services is vital. Q2BSTUDIO, as a software and technology development company, offers cybersecurity and pentesting services that identify security gaps before they are exploited.
Beyond traditional measures, prevention can be reinforced with artificial intelligence technologies. AI agents can analyze anomalous behavior patterns in real time, detecting backdoor-specific activities. Q2BSTUDIO develops custom applications and custom software that integrate artificial intelligence models for companies, including threat detection systems based on machine learning. We also offer AWS and Azure cloud services to deploy secure and scalable infrastructures, as well as business intelligence services with Power BI to visualize security indicators and facilitate decision-making.
Artificial intelligence applied to cybersecurity is one of the fastest growing areas. AI algorithms can identify unknown malware signatures using heuristic analysis. At Q2BSTUDIO we design custom AI agents that integrate into our customers' security systems, providing an extra layer of protection. In addition, our business intelligence services solutions allow you to correlate security events with operational data, offering a holistic view of risk.
In short, GigaWiper reminds us that cybersecurity is not a luxury, but a strategic necessity. Companies that invest in proactive solutions, such as those offered by Q2BSTUDIO, are better prepared to face these threats. From the development of secure applications to the implementation of artificial intelligence and data analytics, our team accompanies organizations on their path to digital resilience. Don't wait to fall victim to an attack – strengthen your security posture today with the support of technology and cybersecurity experts.
.jpg)
.jpg)