Microsoft has dissected a destructive Windows backdoor it calls GigaWiper, notable less for novelty than for construction: three older destructive programs bolted into a single tool, each available as a command the operator can choose, as reported by The Hacker News.

The menu tells you the intent. GigaWiper can wipe disks, pose as ransomware with no intention of ever giving data back, and act as spyware, which lets one operator move between sabotage, extortion theater, and surveillance from the same foothold. Fake ransomware in particular is a tell, because it wears the costume of a payout demand while the real aim is destruction.

Assembling a capable tool from existing parts also lowers the bar. There is no need to write a wiper from scratch when working code can be repackaged, and a modular design means the same backdoor can be pointed at different goals depending on the target and the day.

For defenders, the takeaways are familiar and worth repeating. Offline, tested backups are the only reliable answer to a wiper, because there is nothing to decrypt and no one to pay. Watch for the mass file and disk operations that destructive tools cannot hide, and do not assume a ransom note means the data was ever meant to survive.

Sources: The Hacker News; Microsoft.