logo

GigaWiper Uses OneDrive Update Scheduled Task for Persistent Destructive Access

ID: 0f1ec4cb-2afd-58f1-abd2-0f15588cd0d3

STIX ID: report--0f1ec4cb-2afd-58f1-abd2-0f15588cd0d3

Feed Name: GBHackers

Threat Score
85/100

Date Published: 2026-07-10

Date Updated: 2026-07-21

Author: Mayura Kathir

...
...

**GigaWiper** is a sophisticated Golang-based modular backdoor that consolidates multiple destructive wipers and fake-ransomware routines, maintains stealthy persistence (notably via a scheduled task named “OneDrive Update”), and uses RabbitMQ/Redis for scalable C2 and telemetry; the report includes technical behaviors, code overlap with previous families (Crucio, FlockWiper), mitigation recommendations, and a set of IOCs (SHA-256 hashes and C2 IPs).

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.