Threats Tagged 't1485'

GigaWiper is a sophisticated Golang-based backdoor discovered in October 2025 that integrates command-and-control features with multiple destructive payloads. It combines functionality from at least three malware families, including a physical disk wiper, a fake ransomware component encrypting files with unsaved keys, and an enhanced multi-pass secure wiper. The backdoor supports 20 commands for control, system information gathering, and destructive actions such as disk wiping, screen recording, remote control, BSOD triggering, and event log clearing. Persistence is maintained via scheduled tasks, and communication occurs through RabbitMQ and Redis servers. No specific affected software versions or patches are identified, and no known exploits in the wild have been reported. The severity is assessed as medium based on the destructive capabilities described.

Since late 2025, cybercriminals have been exploiting Wallpaper Engine, a popular live wallpaper application on Steam, to distribute malware through Steam Workshop. Attackers target primarily Chinese and Russian gamers by embedding malicious code within application wallpapers shared on the platform. These compromised wallpapers deliver various malware types including infostealers, backdoors, crypto miners, and ransomware. One analyzed sample dropped DarkKomet backdoor while hijacking Steam sessions to steal account credentials. The malware modifies system libraries to locate Steam installations and exfiltrate data to attacker-controlled servers. Compromised accounts are then used to upload additional malicious wallpapers. The diverse malware families suggest multiple independent hacking groups are exploiting this distribution method. Infected wallpapers received thousands of downloads before removal, with 89% of infections occurring in China.

MediumMalwareBritish Indian Ocean TerritoryCanadaChina+5#account hijacking#vidar#wallpaper engine