BiBiGun

BiBiGun is a threat actor name used for the cluster behind the BiBi-Linux and BiBi-Windows wiper campaigns that emerged during the Gaza conflict in late 2023. The activity is associated with destructive operations against Israeli targets and is characterized by sabotage and data destruction rather than conventional espionage or financially motivated crime. The group has been discussed as a pro-Hamas or anti-Israel actor, and some researchers have noted tactical overlaps with Moses Staff, although a definitive attribution to that group is not established. BiBiGun is known for deploying wiper malware on both Linux and Windows systems. Its operations indicate capabilities consistent with initial access, post-compromise destructive action, and data exfiltration or theft associated with intrusion activity. The actor’s tradecraft aligns with disruptive and destructive intrusion sets active in the Israel-Hamas conflict period, where website disruption, data breaches, and destructive malware were prominent. The most distinctive aspect of BiBiGun’s activity is the use of cross-platform wiper tooling intended to impair victim systems and destroy data at scale. No high-confidence evidence in the available facts supports ransomware operations, extortion activity, or a confirmed nation-state designation. The strongest supported characterization is a politically aligned destructive actor focused on Israeli entities.