Hamsa
Hamsa is a Linux wiper malware family, described as a Bash-based destructive payload used in cross-platform campaigns alongside the Windows wiper Hatef and, in some reporting, BiBi Wiper. It is associated with the Handala Hack Team / Handala persona, which multiple security vendors assess as linked to Iran’s MOIS and also track under related cluster names including Void Manticore, Storm-0842, BANISHED KITTEN, and Dune. Reporting places Hamsa in broader Handala disruptive operations targeting primarily Israeli organizations, with later expansion to U.S., Gulf, and Western targets.
Hamsa was specifically documented in the phishing campaign dubbed Operation HamsaUpdate, which targeted Israeli customers using F5 BIG-IP-themed lures. In that campaign, victims were instructed to run a root-privileged wget command that downloaded and executed an obfuscated script named update.sh. The Linux payload used five layers of Base64 with eval, delayed execution for 30 minutes, fingerprinted the Linux distribution, installed tools including xfsprogs, wipe, and parted, enumerated and deleted user accounts with UID greater than 999, wiped their home directories, unmounted non-root partitions, recreated GPT partition tables, created new partitions, formatted them as XFS, deleted system binaries under /bin, /sbin, /usr/bin, and /usr/sbin while preserving reboot and rm until late in execution, and then rebooted the system to render it inoperable. The malware also reported execution status via Telegram, using the same Bot ID and chat/channel ID observed in the paired Windows variant.
More generally, reporting describes Hamsa as part of a newer generation of Iranian-linked wipers that moved away from MBR destruction toward rapid recursive file destruction. In comparative reporting, Hamsa and BiBi are characterized as Bash-based Linux wipers targeting Linux servers, while Hatef is the .NET-based Windows counterpart. Mentioned infrastructure and IoCs tied to the HamsaUpdate activity include the delivery command using hxxps://sjc1.vultrobjects[.]com/f5update/update.sh, Telegram Bot ID 6428401585:AAGE6SbwtVJxOpLjdMcrL45gb18H9UV7tQA, and Channel/Chat ID 6932028002. High-confidence reporting also places Hamsa among Handala’s destructive malware set, which includes BiBi Wiper, Hatef, CoolWipe, ChillWipe, Cl Wiper, and Handala Wiper.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The group’s wiper malware family includes variants named BiBi Wiper, Hatef, Hamsa (Linux), CoolWipe, and ChillWipe.
Techniques & procedures
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
The most studied example is a phishing campaign from July 2024 that exploited the global CrowdStrike outage. The group sent emails to Israeli organizations with fake remediation tools. Victims who downloaded the archive got hit with a multi-stage chain that ended in a wiper payload erasing their files.
Execution
1 technique
Execution
Privilege Escalation
1 technique
Privilege Escalation
Stealth
2 techniques
Stealth
“obfuscated payload… concealed within… five Base64 encoding steps… executed using the ‘eval’ command.” / “loader conceals its strings with… ADD… AutoIt script… strings… SUB… shellcode… implements the RC4 stream cipher… decrypt another payload… decompressed… LZNT1.”
Discovery
1 technique
Discovery
Command and Control
1 technique
Command and Control
IOCs tracked for this family
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Linux wiper variant associated with Handala’s destructive malware family.
A Bash-based Linux wiper used in cross-platform destructive campaigns and focused on file-level destruction.
A Linux Bash-based destructive wiper used in Handala campaigns.
Linux wiper used by the Handala Hack Team in destructive operations.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.