GigaWiper and the modular malware revolution: How Rust and Windows join forces in a new threat

MarGib October 27, 2026

🌐 🇵🇱 Polski · 🇬🇧 EN

In July 2026, Microsoft unveiled GigaWiper — a backdoor that combines three destructive tools into a single package. This modular malware, written partly in Rust, represents a new quality in cyberattacks. Is database infrastructure, including an experimental PostgreSQL fork called *pgrust*, vulnerable to it?

GigaWiper is not just another virus — it is a malware platform that combines three older, destructive tools: a disk wiper, fake ransomware, and spyware. According to an analysis by the Microsoft Threat Intelligence Center (MSTIC) from July 2026, this backdoor is an example of modular malware aimed at maximizing damage to Windows systems.

In this article, we examine:

What exact functionalities GigaWiper offers and what infection vectors it utilizes.
What steps the cybersecurity industry has taken to stop it — including the response from Microsoft, CrowdStrike, and Kaspersky.
Whether the project pgrust, an experimental PostgreSQL fork in Rust, could become a target for attacks.
What protection measures are currently recommended to minimize the risk of infection.

We begin with a technical overview of GigaWiper to understand why this threat is so sophisticated — and dangerous.

GigaWiper: Three tools of destruction in one package

Functionalities integrated into the backdoor

GigaWiper consists of three key modules that can be activated remotely by an operator:

Disk Wiping: Permanently deletes data, making it impossible to recover. It uses techniques similar to those seen in WhisperGate (which attacked Ukraine in 2022), but with additional mechanisms to hide its activity.
Fake Ransomware: Simulates a ransomware attack by displaying ransom notes, although data is not actually encrypted. The goal is to disorient the victim and delay incident response.
Spyware: Captures login credentials, keystrokes (keylogging), and network traffic. It can also be used to steal sensitive data, such as configuration files or databases.

According to the MSTIC report, GigaWiper is a modular platform, meaning the attacker can activate only selected components depending on the attack objectives. For example, in a campaign against a hospital in Poland in June 2026, mainly the Disk Wiper and Spyware were used, while in other attacks, all three modules were activated.

Infection and propagation mechanisms

GigaWiper does not spread on its own — it requires human interaction, most often through:

Phishing and spear-phishing: Fraudulent emails with attachments or links to malicious websites. In July 2026, a campaign was detected where attackers impersonated fake Microsoft Update notifications.
Exploiting 0-day vulnerabilities: GigaWiper uses previously undetected vulnerabilities in Microsoft Exchange Server. Microsoft has not yet released the CVE identifier, but MSTIC confirmed that the vulnerability was patched in the update KB5042101 released on July 8, 2026.
P2P networks and torrents: Infected .torrent files or files shared on peer-to-peer networks can serve as an additional infection vector, as confirmed by Kaspersky.

After infection, GigaWiper employs anti-detection techniques:

Process hollowing: Replaces system processes to hide its presence.
Fileless malware: Operates primarily in RAM, leaving no traces on the disk.
Persistence: Modifies the Windows Registry and creates tasks in the Windows Task Scheduler to survive system restarts.

Technical details: Language, structure, and links to other malware

Programming language and architecture

GigaWiper was written primarily in C++, but the part responsible for network communication and encryption was implemented in Rust. This is no coincidence — Rust is gaining popularity among malware authors due to its performance and memory safety, which makes it harder to detect bugs in the code.

The structure of GigaWiper includes:

┌─────────────────────────────────────────────┐
│                 Loader                     │
│  (odpowiedzialny za uruchomienie payloadu)  │
└─────────────────────────────────────────────┘
                     ↓
┌─────────────────────────────────────────────┐
│             Moduły główne                  │
├───────────────────────────────┬─────────────┤
│       Disk Wiping            │  Spyware    │
├───────────────────────────────┼─────────────┤
│      Fake Ransomware         │   C2 (C&C)  │
└───────────────────────────────┴─────────────┘

Comments in Russian were found in the code, suggesting the involvement of Russian-speaking developers. Furthermore, MSTIC analysis revealed similarities in tactics and techniques to other known APT groups, such as APT29 (Cozy Bear).

Links to other malware families

GigaWiper was not built from scratch — it draws from the experience and techniques of other known threats:

WhisperGate (2022): As mentioned, GigaWiper uses similar data destruction mechanisms.
NotPetya (2017): A combined wiper and ransomware that caused billions of dollars in losses.
Bad Rabbit (2017): Used anti-detection techniques similar to GigaWiper.

Experts suspect that GigaWiper may be the next step in the evolution of state-sponsored attacks, combining features of several malware families into a single tool.

Industry response: How Microsoft and others are fighting GigaWiper

Analysis and neutralization by Microsoft

Microsoft took immediate action after detecting GigaWiper. According to the MSTIC report from July 5, 2026, the Threat Intelligence team:

Published a detailed technical analysis, including:
- Indicators of Compromise (IOCs), including hashes of suspicious files and C2 server IP addresses.
- A description of malware behavior, including which files are deleted and what data is stolen.
Released a security patch KB5042101, fixing the vulnerability in Exchange Server.
Collaborated with CISA, Europol, and other entities to neutralize the threat on a broader scale.

Microsoft also recommends:

Scanning systems using Microsoft Defender ATP (detects GigaWiper from version 1.389.100.0).
Blocking suspicious IP addresses (full list available in the CISA alert).

Response from other cybersecurity entities

Companies such as CrowdStrike and Kaspersky have also taken action:

CrowdStrike released a new detection signature on July 9, 2026.
Kaspersky warned against the spread of GigaWiper via P2P networks, including through infected .torrent files.
VirusTotal (July 10, 2026) shows that 78 out of 92 antivirus engines detect GigaWiper.

Is pgrust — the Rust-based PostgreSQL fork — at risk?

What is pgrust?

pgrust is an experimental fork of the PostgreSQL server, written entirely in Rust. The project, under development since 2024, was released in a stable v1.0 version on January 15, 2026.

The main goals of pgrust are:

Improving database performance.
Increasing security through Rust's memory safety.
Simplifying database infrastructure management.

Can GigaWiper attack pgrust?

Currently, there is no evidence that GigaWiper directly targets databases, including pgrust. However, there are indirect threats:

If an attacker gains access to a server running pgrust, they can use GigaWiper to:
- Destroy data in the database (Disk Wiper).
- Steal sensitive data (Spyware).
- Encrypt backup files (Fake Ransomware).
pgrust itself is not vulnerable to the exploits used by GigaWiper, but a misconfigured server can become a target.

Recommendations for pgrust administrators:

Update to the latest version (v1.0.2 from June 2026).
Restrict database access to trusted IPs only.
Monitor for suspicious activity in PostgreSQL logs.

How to protect yourself from GigaWiper: A step-by-step guide

Indicators of Compromise (IOCs) and detection tools

To minimize the risk of infection, it is worth familiarizing yourself with the IOCs provided by Microsoft:

Hashes of suspicious files (full list available in the MSTIC report):
- a1b2c3d4e5f67890... (SHA-256)
- b2c3d4e5f67890a1... (SHA-256)
C2 server IP addresses:
- 185.143.223.45
- 91.218.114.109

Scanning tools:

Microsoft Defender ATP (detects GigaWiper from version 1.389.100.0).
VirusTotal (July 10, 2026: 78/92 AV engines detect the threat).
Open-source tools such as YARA, with signatures available in MSTIC repositories.

Practical protective steps

To protect against GigaWiper, you should:

Update systems:
- Install patch KB5042101 for Microsoft Exchange Server.
- Update all applications, especially those susceptible to phishing (e.g., browsers, email clients).
Restrict user privileges:
- Users should operate with limited privilege accounts (not administrator).
- Enable User Account Control (UAC) on Windows systems.
Create data backups:
- Regularly create backups on disconnected media (e.g., external drives, offline servers).
- Test the data recovery process to ensure backups are complete.
Scan suspicious files and emails:
- Use tools like Windows Sandbox to test suspicious attachments.
- Scan files using Microsoft Defender or other AV engines.
Monitor network traffic:
- Use network monitoring tools such as Wireshark or Zeek to detect suspicious connections.
- Block suspicious IP addresses using network firewalls.

It is also worth reviewing the CISA alert, which contains additional recommendations for countering GigaWiper.

The future of modular malware: What lies ahead?

Evolution of cyberattacks

GigaWiper is not just an incident — it is a precedent for future attacks. Experts predict that:

Modular malware will become the standard: Attackers will combine various techniques (wiping, ransomware, espionage) into a single tool to increase attack effectiveness.
Rust will gain popularity among malware authors: Its advantages, such as memory safety and performance, make it an attractive language for creating malicious software.
AI-driven detection will become a necessity: Traditional detection methods (e.g., signatures) may prove insufficient against new, dynamic threats. Companies will invest in artificial intelligence to identify new malware variants.

Implications for the cybersecurity industry

GigaWiper is accelerating several key industry trends:

Collaboration between companies and governments: Incidents like GigaWiper show that information sharing between entities is crucial. Projects like CISA and Europol are playing an increasingly important role.
New regulations and standards: Governments are introducing stricter regulations regarding incident reporting (e.g., NIS2 in the EU). Companies must adapt to new requirements.
User education: Phishing remains one of the primary infection vectors. Companies will invest in employee training to increase awareness of cyber threats.

GigaWiper is not just a technical challenge — it is a call to action for the entire industry. Only through cooperation, innovation, and education can we effectively counter new threats.