Loading malware…
BiBi Wiper is a destructive malware family used in operations targeting Israeli organizations during and after the October 2023 Israel–Hamas war. It is associated with Iran-linked activity clusters tracked as VOID MANTICORE and Storm-0842, and has also been deployed under personas including KarmaBelow and Handala that multiple security firms and government reporting link to Iran’s Ministry of Intelligence and Security. The malware is intended to damage systems and disrupt operations rather than generate ransom revenue.
BiBi Wiper is documented primarily as a Windows wiper. Reported variants and related tooling have also appeared alongside broader destructive campaigns affecting both Windows and Linux environments, but the core BiBi Wiper sample described in public reporting is a 64-bit Windows executable. Its behavior includes enumerating logical drives and system information, recursively traversing directories, and overwriting files with junk data to corrupt them. It has been observed renaming damaged files with BiBi-themed extensions and can default to targeting user-profile data when launched without operator-supplied arguments.
The malware also inhibits recovery by deleting shadow copies and disabling Windows recovery-related settings through native command execution. This combination of file destruction and recovery suppression is consistent with disruptive and psychologically oriented operations designed to maximize operational impact. Reporting characterizes the implementation as relatively straightforward rather than highly sophisticated, relying heavily on standard Windows APIs and built-in system utilities to carry out destructive actions.
BiBi Wiper has been used in campaigns against Israeli government and private-sector targets and forms part of a wider ecosystem of custom wipers attributed to the same Iran-linked operators. Within that broader toolkit, it sits alongside other destructive families used for sabotage, coercion, and information operations rather than conventional financially motivated ransomware.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
KarmaBelow has targeted the Israeli government, deploying destructive malware called the “BiBi wiper” (named after Israeli Prime Minister Benjamin “Bibi” Netanyahu).
14 distinct techniques documented for this family, organized by ATT&CK tactic.
The most studied example is a phishing campaign from July 2024 that exploited the global CrowdStrike outage. The group sent emails to Israeli organizations with fake remediation tools. Victims who downloaded the archive got hit with a multi-stage chain that ended in a wiper payload erasing their files.
Using the ‘CreateProcessA’ API function, four command prompts are opened to execute specific commands. cmd.exe /c vssadmin delete shadows /quIet /all cmd.exe /c wmic shadowcopy delete cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures cmd.exe /c bcdedit /set {default} recoveryenabled no
The malware author uses a legitimate Microsoft manifest file to evade detection by security products.
The wiper collects information about the date and time of the system... The wiper execution produces system information related to system paths, processor cores, threads, rounds, and stats... The malware uses the ‘GetNativeSystemInfo’ API function to determine the processor architecture of the system and whether it is a 32-bit or 64-bit processor.
The Wiper malware uses the ‘FindFirstFileExA’ API function to search for files, directories, and sub-directories. The starting point for the search is the path that the threat actor specified during the execution of the Wiper, or it defaults to the ‘C:\Users’ path... Then, the malware continues the search progress with the ‘FindNextFileW’ function.
In its initial execution, the malware collects information about the system’s disk drives using the ‘GetLogicalDrives’ API function. Malware uses this function to detect disk drives on systems and attempt to spread itself across these drives. After gathering information about the disk drives on the system, the malware uses the ‘GetDriveTypeA’ API function to determine the type of each drive, such as removable, CD-ROM, network, etc.
During the war, a pro-Hamas hacker group attacked Israeli companies with the ‘BiBi’ wiper, corrupting and disrupting their operating systems without demanding a ransom... The malware’s purpose was to destroy and corrupt the files in the operating system of the target without demanding any ransom.
The malware author executes specific commands to remove shadow copies, which can make it difficult to restore data from backups. cmd.exe /c vssadmin delete shadows /quIet /all cmd.exe /c wmic shadowcopy delete ... cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures ... cmd.exe /c bcdedit /set {default} recoveryenabled no
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Destructive malware used against Israeli government targets; characterized in the content as a wiper intended to damage systems rather than for financial gain.
A wiper malware variant used by Handala for destructive attacks that erase or destroy victim data.
A wiper malware referenced as part of Handala’s historical toolkit, associated with destructive operations and detectable via file extension patterns.
Custom wiper malware used for destructive actions, including data destruction and disk wiping.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.