Redazione RHC : 18 October 2025 21:55
Gigabyte is the pseudonym of Kimberley Vanvaeck, a Belgian hacker known for writing numerous high-end malware, as well as for a long-running dispute with the security firm Sophos.
Gigabyte, when she was just 18 and a senior in high school, made headlines by writing the Sharpei malware, the first to target the Microsoft .NET Framework.
Kimberly Vanvaeck was born in Mechelen, Belgium, in 1984, a city a few kilometers north of Brussels. She began programming at a very young age. At the age of six, she was already using and programming her own Commodore 64, a computer lent to her by a relative.
She started programming viruses at the age of 14, working for the Metaphase VX team and then Coderz , always as a hobby. The computer science teacher at her school was truly amazed by Kimberly’s programming skills. And although he didn’t share her passion, they had a good friendship.
She was 17 years old in 2001 when Microsoft began the first releases of the .NET Framework, and so Kimberly, attracted by technological innovation , began writing Sharpei, the first computer virus written in “C#” code, for the Microsoft .NET Framework.
She has always been a good student and very active in academics outside the classroom, participating in student groups. She studied applied computer science. After completing her secondary school studies, she went to Hanoi, Vietnam, to Hanoi University of Technology to participate in an engineering project on multilayer data traffic, which actually served as her thesis.
She graduated in industrial engineering from Electronics-ICT and currently works where she studied, at the Erasmushogeschool Brussels as an IT consultant.
She’s passionate about kickboxing, dancing, and loves animals (especially horses). She enjoys trance and house music. Gigabyte doesn’t play video games, and her favorite programming language is C++.
Sharpei was composed of three different parts written in three different programming languages.
The binary part is a simple dropper that checks for the presence of the . NET environment on the machine. When started, it first copies itself to ” C:MS02-010.exe” , then drops the mass-mailer part written in Visual Basic Script into a file called “Sharp.vbs”.
The .NET component is dropped into the Windows directory as “cs.exe”. If the .NET environment is available, the dropper launches the .NET component.
When the .NET component starts, it first drops a small Visual Basic Script file into the user’s startup directory. The script displays the following message the next time the user logs in.
The virus then infects all EXE files in the system directory and three other selected directories. The virus code is prepended to the host file. When the infected file is launched, it first attempts to infect other files, then writes the program to a temporary file (‘temp.exe’) and launches it.
In the world of virus writing, many who have been involved agree that Gigabyte has no destructive drive in its virus development, but rather learning and experimentation.
Its viruses are, more than anything else, proofs of concept (PoC) without causing significant damage to computers.
So much so that one of his viruses ( YahaSux) eliminated the small amount of damage that a previously released virus ( Yaha) had been able to do. The viruses Gigabyte wrote are:
Writing her viruses, as we said, she was part of a number of underground groups such as “Metaphase VX” and “Coderz” and was the main editor within the e-zine “Coderz.Net”, where she wrote the introductions of the 3 issues that were published, as well as a number of specific articles within.
Gigabyte is also known for frequent clashes with ubiquitous Sophos spokesman Graham Cluley over his sociological analysis of virus writers.
The source of Gigabyte’s discontent was comments made by Cluley a few years earlier, claiming that most virus writers were male. Since then, Gigabyte has been on a mission to prove that women can cause just as much havoc as male virus writers.
As mentioned, Gigabyte wrote several malware attacks, all identified with a strong anti-Cluley theme. One launched a game on infected PCs that challenged readers to answer questions about the man the author had nicknamed “Clueless.” Another game required infected users to cut off Cluley’s head.
Ironically, it was Gigabyte’s strong self-publicist streak that led to its downfall. Carole Theriault, a security analyst at Sophos, said:
“It’s normally incredibly difficult to track down virus writers, but when they start coming out and bragging about what they’re doing, it can often help us find their whereabouts.”
On February 16, 2004, the newspaper ” La Libre Belgique” reported that a 19-year-old technology student had been arrested in Belgium, accused of using the pseudonym ” Gigabyte” .
He was charged with 11 counts of computer sabotage, punishable by up to three years in prison and fines of up to €100,000.
Police seized five computers owned by Gigabyte and shut down its website ( http://coderz.net/gigabyte/ ) as they feared new threats would be sent.
She was released on bail 24 hours later.