HTTPSnoop
HTTPSnoop is malware associated with the Iranian-aligned threat cluster Druidfly, also referred to as Homeland Justice and Karma. Reporting states that Druidfly maintained BibiWiper capability pre-staged with HTTPSnoop, alongside AnyDesk, ScreenConnect, and ReGeorg web shells, making its presence part of a recognizable pre-destructive indicator chain. HTTPSnoop was also reported to have been deployed prior to Druidfly wiping attacks against Israel, indicating its use in attack preparation and pre-positioning before destructive operations. Based on the provided content, HTTPSnoop is linked to Iranian-aligned activity targeting Israel and is notable as an operational precursor observed before BibiWiper-related destructive incidents. No additional technical details, infection vector specifics, or standalone indicators of compromise were directly provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Tracing other tools used to initiate the BibiWiper attacks against Israel revealed the following overlap in tactics, techniques, and procedures between these attacks and earlier Druidfly attacks: HTTPSnoop malware was previously deployed prior to the Druidfly wiping attacks.
HTTPSnoop malware was previously deployed prior to the Druidfly wiping attacks
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Persistence
1 techniqueDruidfly, also known as Homeland Justice and Karma, maintains BibiWiper capability pre-staged with HTTPSnoop malware, AnyDesk, ScreenConnect, and ReGeorg web shells as a recognisable pre-destructive indicator chain.
Lateral Movement
1 technique“PDQ remote access tool… used for remote access and persistence… Use of the remote desktop tools AnyDesk and ScreenConnect”
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware used in a pre-destructive indicator chain alongside BibiWiper capability.
Malware used prior to Druidfly wiping attacks, serving as part of the intrusion chain before deployment of destructive payloads.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.