Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
10 IOCs
GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware
Excerpt
In this article A wiper inside a backdoor Backdoor capabilities How GigaWiper was assembled Conclusion: Multiple destructive capabilities consolidated into a single implant Defending against destructive threats Microsoft Defender detections Indicators of compromise In October 2025, Microsoft Threat Intelligence identified destructive wiping activity and uncovered a sophisticated Go programming language (Golang)-based backdoor we now track as GigaWiper, a versatile implant…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →10 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 3c30deb6556a94cfb84ae51798f4aecfae8c7358e55fdb321c5f2376579631cd | Medium | Score 53/100 | First seen |
| SHA256 | f622ed85ef31ad4ab973f4e74524866fe1bb44f0965ad2b2ad796cd657a05bfd | Medium | Score 53/100 | First seen |
| SHA256 | db41e0da7ab3305be8d9720769c6950b4dc1c1984ef857d3310eb873a0fc7674 | Medium | Score 53/100 | First seen |
| IP | 185.182.193.21 | High | Score 58/100 | First seen |
| SHA256 | ce9ad5f6c12019f4aae5b189bd8ddf5bb09e75b06a0a587b25a855c65948c913 | Medium | Score 56/100 | First seen |
| IP | 212.8.248.104 | High | Score 58/100 | First seen |
| SHA256 | 440b5385d3838e3f6bc21220caa83b65cd5f3618daea676f271c3671650ce9a3 | High | Score 86/100 | First seen |
| SHA256 | 12c39f052f030a77c0cd531df86ad3477f46d1287b8b98b625d1dcf89385d721 | Medium | Score 53/100 | First seen |
| SHA256 | 633d4cbd496b1094495da89a64f5e6c31a0f6d4d1488411db5b0cba1cfe42001 | Medium | Score 56/100 | First seen |
| SHA256 | 9706a192e2c1a1faaf0a521daf31c2af60ff4590e3f47bbb4abc227f42af0683 | Medium | Score 56/100 | First seen |
IOC Relationship Graph
Building graph…