BiBi Wiper: A Politically Charged Cyberattack Targets Israeli Defense and Data Sectors
- Actor Motivations: Disinformation,Sabotage
- Attack Vectors: Security Misconfiguration,Vulnerability Exploitation,Wiper
- Attack Complexity: Medium
- Threat Risk: High Impact/High Probability
Threat Overview
In October, a significant cyberattack targeted Israel, affecting defense contractors and a data-hosting company. This operation, known as "Mission: Data Destruction," employed a new data-wiping malware, BiBi-Linux, with a Windows variant called bibi.exe, to cause extensive data loss. The hacktivist group Karma, linked to these attacks, used this campaign to express political dissent against Israeli Prime Minister Benjamin Netanyahu. These incidents were part of a larger trend of hacktivist groups using data destruction methods, with similar tactics observed in other groups like the Iranian-linked APT, Moses Staff. The campaign involved manual data deletion and spreading malware within networks.
Detected Targets
| Type | Description | Confidence |
|---|---|---|
| Sector | Defense | Verified |
| Sector | Information Technology | Verified |
| Region | Israel | Verified |
Extracted IOCs
- de9da4fcfb8320b9d34239effce1871a
- e26bba0304f14ef96beb60376791d32c
- 0dbabdc1ae8c3c8a48224ee3c3e8b6a17f41d6e7
- 24f6785ca2e82d1d1d61f4cb01d5e753f80445cf
- 23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad
- 40417e937cd244b2f928150cae6fa0eff5551fdb401ea072f6ecdda67a747e17
Tip: 6 related IOCs (0 IP, 0 domain, 0 URL, 0 email, 6 file hash) to this threat have been found.
Overlaps
Source: Backberry - November 2023
Detection (two cases): 40417e937cd244b2f928150cae6fa0eff5551fdb401ea072f6ecdda67a747e17, e26bba0304f14ef96beb60376791d32c
Source: Security Joes - October 2023
Detection (one case): 23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad
Hint: Overlaps are extracted automatically by examining the IOCs associated with all indexed threats and actors.
FAQs
The "Karma" & BiBi-Linux Wiper Campaign
Following the escalation of conflict on October 7, 2023, cyber-attacks against Israeli organizations surged dramatically. A new threat group began infiltrating corporate networks to deploy a data-destroying malware known as BiBi-Linux. They also manually wiped servers to ensure maximum disruption of business operations.
A newly surfaced hacktivist group calling themselves "Karma" has claimed responsibility for these breaches. While they pretend to be domestic political dissidents, security researchers believe they are pro-Palestinian actors. They share significant behavioral and technical similarities with "Moses Staff," a known Iranian state-linked hacker group.
The primary goal of this campaign is pure sabotage and the devastation of the target nation's economy. Unlike ransomware attacks, there are no demands, extortions, or negotiations involved. The attackers simply want to wipe out operational data and cause irreversible damage to the infrastructure.
The campaign has had a fairly broad impact, successfully breaching numerous companies. The attackers zeroed in on critical infrastructure components, successfully wiping entire hosting servers and manipulating connected hardware like printers to spread their messaging.
Yes, the attackers primarily targeted Israeli IT providers, data-hosting companies, defense contractors, and government or homeland security agencies. By focusing on these specific resources, the attackers aimed to cripple day-to-day operations and access sensitive national defense information.
The hackers broke in by finding vulnerable, publicly exposed administrative login pages on the internet. Once inside the network, they moved toward central management servers to spread their wiper malware and manually delete system data. They also renamed computers and forced printers to print their group's logo to announce their presence.
IT and data-hosting companies are prime targets because they hold the data and infrastructure for many other businesses, allowing an attacker to cause widespread disruption from a single breach. Defense and government contractors are highly attractive for adversaries seeking to undermine a nation's security and military readiness during a conflict.
Organizations must urgently assess their internet-facing systems to secure or hide any exposed administrative login panels. It is critical to mandate multi-factor authentication (MFA) for all users and ensure that security software is updated to block the newly discovered BiBi-Linux malware.
While the attacks are highly targeted against specific Israeli sectors, the resulting fallout is widespread. Because IT and hosting providers are primary victims, the destruction cascades down to simultaneously affect many of their clients whose data is housed on the compromised servers.