GigaWiper Malware Unites Three Families into a Single Destructive Go Backdoor
What Happened — Microsoft identified a new modular backdoor, dubbed GigaWiper, that fuses code from three prior malware families. The implant, written in Go, provides espionage, remote‑control, and multiple disk‑wiping capabilities, persisting via a scheduled task masquerading as a OneDrive update.
Why It Matters for Compliance & Audit Readiness —
- Demonstrates how a single implant can bypass fragmented endpoint controls, underscoring the need for continuous, mapped security controls that can be evidenced during a SOC 2 audit.
- Highlights the importance of maintaining up‑to‑date detection coverage and audit‑ready logs for scheduled tasks and registry artifacts.
- Aligns with Verisq’s Control Mapping capability, which automates evidence collection for endpoint‑security controls to satisfy SOC 2 Trust Services Criteria.
Who Is Affected — Primarily technology and SaaS providers, cloud‑infrastructure operators, and any organization with Windows endpoints.
Recommended Actions — Map endpoint‑security controls (e.g., scheduled‑task monitoring, registry change detection) to SOC 2 criteria, implement continuous log collection, and validate that evidence is retained for audit review. Source: Security Affairs
Technical Notes — The backdoor uses RabbitMQ for C2, Redis for result exfiltration, and persists via a “OneDrive Update” scheduled task. Destructive commands include raw‑disk wiping, forced BSOD, and unrecoverable encryption with a .candy extension. Source: Security Affairs