eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
GigaWiper: Modular Destructive Backdoor Disclosed
Bottom Line: Researchers from Microsoft have identified a new destructive backdoor malware dubbed GigaWiper, which provides threat actors with both backdoor and data destruction capabilities.
On July 9th, 2026, Microsoft Threat Intelligence published an in-depth analysis of GigaWiper, a Golang-based backdoor that has not been previously reported. It was first discovered in October of 2025 and stands out due to capabilities including destructive payloads, disk wiping, and fake ransomware messages.
GigaWiper incorporates three distinct destructive capabilities as operator-selectable backdoor commands. First is a standalone disk wiper that operates at the physical level, enumerating drives via Windows Management Instrumentation (WMI), removing partition metadata from non-OS drives, overwriting raw disk content, and forcing a reboot. Second is a Crucio ransomware-derived command that encrypts files with randomly generated keys that are never saved, making recovery impossible regardless of payment. A third wiping command reimplements FlockWiper logic in Golang with added multi-pass secure wiping.
Beyond its destructive payload suite, GigaWiper provides a comprehensive set of operational capabilities for sustained access and intelligence collection. These include:
- PowerShell command execution with persistent working directory state across sessions
- Screenshot capture and continuous screen recording
- System information collection including installed antivirus software queried via PowerShell
- File encryption and decryption utilities
- File exfiltration via the MinIO client
- Full process, service, and registry management
- Windows event log clearing covering System, Setup, Application, Security, and ForwardedEvents logs
- VNC-like remote desktop capability delivering full keyboard and mouse control with live screen streaming over TCP
The breadth of these capabilities allows operators to conduct extended, quiet intelligence collection before choosing the timing and method of destructive action.
eSentire Threat Intelligence Analysis:
GigaWiper represents a significant evolution in destructive malware architecture. Traditional wipers are single-purpose tools deployed at the conclusion of an intrusion for immediate, irreversible impact. Previous wipers have sacrificed persistence and stealth for speed of destruction. GigaWiper stands out as the destructive payloads are on-demand options within a persistent, fully capable espionage backdoor.
While Microsoft has shared technical details on the malware, they do not discuss real-world attacks or provide attribution to a known threat group or state. One potential clue for attribution is the use of Crucio ransomware components. Crucio has previously (2023/2024) been employed by Iranian affiliated threat actors including the CyberAv3ngers, in attacks targeting critical water and wastewater infrastructure. GigaWiper would be a highly valuable tool for Iranian APTs, as during peace times it would allow for persistent access and data theft, and during active conflicts, infections could be weaponized for destructive purposes. If GigaWiper is an Iranian tool, it may be employed in attacks against Western organizations in response to the ongoing U.S./Iran conflict.
Alternatively, it is possible that tools incorporated were specifically chosen as a False Flag, to misdirect attribution attempts. The tools capabilities would make it a valuable addition to a number of different state and financially motived threat groups.
eSentire is actively tracking this topic for additional details and detection opportunities. Known malicious infrastructure is blocked via eSentire's Global Deny list for all MDR for Network customers. Additionally, Indicator-based threat hunts are ongoing.
Newly Identified Group Helix Conducting Vishing and Data Extortion Attacks
Bottom Line: The newly identified group Helix is performing data extortion operations through vishing attacks and the abuse of device code authentication flows.
On July 8th, 2026, ReliaQuest published information on an ongoing data extortion campaign, attributed to the newly identified group, Helix. The campaign involves the use of voice phishing (vishing), where threat actors use impersonation tactics to trick users into following device code authentication flows, providing direct access to their Microsoft 365 account. The attackers then use this access to enumerate and exfiltrate data from SharePoint, for data extortion purposes.
Prior to contacting a target organization, Helix performs extensive research and reconnaissance, with the objective of having enough information about the target and organization to hold up in a live phone call. In one observed instance, Helix impersonated the direct manager of a target, using real contact details and caller ID spoofing. The group also registers phishing domains which are tailored to each target organization and used to initiate device code authentication flows. Authenticator apps are registered to victim accounts to maintain persistent access, and tools are used to automate the enumeration and bulk downloading of SharePoint data.
Helix has been assessed as emerging from the defunct threat group BlackFile, which disbanded in April 2026 and fragmented into “multiple successor operations”, including Pink and Redact. The timing, infrastructure, and Tactics, Techniques, and Procedures (TTPs) used by Helix match with reports of BlackFile, suggesting a possible link and further continuation of their operations, but no specific attribution is provided.
eSentire Threat Intelligence Analysis:
ReliaQuest notes that Helix’s “multi-target data extortion campaign” is ongoing but does not provide any specifics on targeted industries. However, the report highlights that high-visibility employees were frequently targeted within the campaign, noting that the attackers were “pursuing the kind of broad access these roles hold”. This targeting could also be linked to publicly available information that Helix can find when performing research prior to initiating attacks, which can be leveraged to craft more convincing and personalized pre-texts for social engineering.
While Helix shares similarities with BlackFile, the report also highlights some overlap with ShinyHunters, a high-profile threat actor tied to The Com and known to conduct similar social engineering and data extortion attacks. Similarities between Helix and ShinyHunters include overlapping infrastructure and registering domains to impersonate targets using the same registrars, but no direct evidence is given to indicate a relationship between the groups. The TTPs have also become adopted by other threat actors within their campaigns, making specific attribution between the various groups difficult. The emergence of Helix following BlackFile’s disbandment is notable, as it illustrates a well-established pattern in data extortion ecosystems, where operational shutdowns do not eliminate threats, but redistributes personnel, playbooks, and infrastructure to successor groups. Further fragmentation and rebranding of this threat cluster is likely possible, as BlackFile’s shutdown reportedly produced at least three known successor identities in Pink, Redact, and Helix.
To protect against the threat posed by Helix, and similar data extortion campaigns, organizations should restrict device code authentication flows, unless required. Organizations should also conduct Phishing and Security Awareness Training (PSAT) to educate users on how to identify and report malicious content, and implement out-of-band verification for employees to validate requests. eSentire's Threat Intelligence team is continuing to track Helix, and similar data extortion campaigns, for additional information and detection opportunities. eSentire's Threat Response Unit (TRU) will discuss vishing attacks leading to data exfiltration within the TRU Intelligence Briefing on July 14th, 2026.
UNK_MassTraction Exploits Roundcube Webmail Vulnerabilities
Bottom Line: A suspected Chinese affiliated APT group, dubbed UNK_MassTraction, has been identified targeting U.S. and Canadian universities.
On July 7th, 2026, Proofpoint published a report on the UNK_MassTraction threat cluster, which is suspected to be affiliated with China. The campaign involves the exploitation of vulnerabilities within Roundcube mailservers to deploy webshells for persistent, long-term access. Proofpoint highlights that UNK_MassTraction has been targeting universities within Canada and the U.S., specifically in the physics and engineering departments, with a focus on “administrators and professors in departments with either national security ties, or entities studying astrophysics and particle physics”.
Initial access used by the group is CVE-2024-42009 (CVSS: 9.3), a Cross-Site Scripting (XSS) vulnerability within Roundcube mailservers, which can allow an attacker to execute JavaScript inside the victim’s web browser. Exploitation of CVE-2024-42009 only requires the user to open the malicious email within the “webmail client of a vulnerable Roundcube instance” and involved emails that resembled marketing or spam content. The vulnerability is used to execute a JavaScript loader to deploy the IceCube malware, which steals credentials and other sensitive information stored within the browser. IceCube is also used to exploit another Roundcube vulnerability, CVE-2025-49113 (CVSS: 9.9), in order to deploy the SquareShell webshell or VShell backdoor, used to establish persistent access.
eSentire Threat Intelligence Analysis:
The specific targeting of academically and nationally significant research departments suggests UNK_MassTraction is conducting intelligence collection rather than opportunistic credential theft. This is part of a sustained pattern, where China aligned threat actors target research and technology companies to steal sensitive data. According to CISA, data stolen by these groups is used for “advancing their economic prowess and competitive advantage”; a paper from Harvard Kennedy School claims that this data theft “represents losses to the United States in the range of hundreds of billions of dollars per year.” The publication of tools and techniques used in this campaign may result in UNK_MassTraction limiting activity or retooling to evade detection, but continued activity is expected in the future.
UNK_MassTraction’s choice of a Roundcube webmail vulnerability as the initial access vector mirrors tradecraft used in previous Chinese APT campaigns against mailserver infrastructure. This includes UNC4841’s exploitation of Barracuda ESG appliances, where edge mail infrastructure was treated as a pivot point into the target network rather than a data store in itself.
Organizations, especially those involved in sensitive research or education, should prioritize the immediate patching of all mailservers. Organizations utilizing RoundCube are recommended to review assets for any signs of unusual activity.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
