BiBi
BiBi is a destructive wiper malware family observed in both Linux and Windows variants. Reporting cited in the source material describes it as a cross-platform wiper, with Linux-targeting variants implemented as Bash-based wipers and a Windows variant also observed in the wild. The malware has been associated with disruptive operations against Israeli targets and is described as having been named for political reasons referencing Benjamin “Bibi” Netanyahu. Source material attributes BiBi-related activity in one report to the Hamas-affiliated group Arid Viper, while other reporting links BiBi use to Iranian state-aligned or MOIS-linked activity, including Handala and incidents tied to UNC1860; these differing attributions are present in the provided content and should be treated accordingly.
Capabilities described in the content center on destructive impact rather than monetization. BiBi is characterized as a wiper used to disrupt victim environments, including healthcare, education, infrastructure, and other Israeli targets. The broader reporting on this generation of Iranian-aligned wipers states that BiBi, alongside Hatef and Hamsa, reflects an evolution toward cross-platform destructive capability. These wipers are described as favoring rapid recursive file destruction by overwriting files with 4096-byte blocks of random data, rather than relying on master boot record wiping. The Windows variant has also been reported using the Windows Restart Manager library (RstrtMgr.dll) to terminate security processes, a technique noted in the content as also seen in Conti and Cactus ransomware operations.
Operational context in the provided material includes use by Handala for combined information gathering and system disruption, particularly against healthcare, education, and infrastructure sectors, with accompanying public messaging for political influence. Additional reporting in the content states that BiBi was used in destructive campaigns affecting Albania and Israel, alongside other wipers such as No-Justice, and that subsequent intrusions tied to UNC1860/MOIS-linked activity leveraged BiBi, also referred to as BABYWIPER in one source. The content does not provide stable, malware-specific indicators of compromise such as hashes or domains.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Handala combines information gathering and system disruption to paralyze healthcare, education, and infrastructure with BiBi/Hatef wiper and expand political influence with public messaging.
One wiper malware example was named BiBi for political reasons (to provoke the Israeli government and the man leading it, Benjamin “Bibi” Netanyahu.) The malware was discovered both for Linux and Windows systems, indicating sophisticated capabilities on the part of the originator.
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A wiper used for system disruption against organizations in healthcare, education, and infrastructure.
A Bash-based Linux wiper used in cross-platform destructive operations, focused on rapid file-level destruction.
A wiper referenced as having used Windows Restart Manager (RstrtMgr.dll) to terminate security processes, facilitating destructive activity by disabling defenses.
Destructive wiper (BABYWIPER) used in intrusions in Albania and Israel.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.