Loading malware…
BibiWiper is a destructive wiper malware associated in the provided content with Iranian-aligned activity. It is described as part of a confirmed destructive payload suite alongside Shamoon 4.0, Meteor, and MuddyViper. The content states that Druidfly reappeared in 2023 targeting Israel with this wiper, and that the name likely references Israeli Prime Minister Benjamin Netanyahu’s nickname, “Bibi.” High-confidence details in the content are limited to its destructive role, its use against Israeli targets, and its association with Druidfly. No specific infection vector, technical behavior, platform details, or indicators of compromise are provided in the source content.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Druidfly reappeared in 2023, when it began targeting Israel with a wiper called BibiWiper, seemingly named after Israeli Prime Minister Benjamin Netanyahu, whose nickname is “Bibi”.
The wiper deployed in these attacks was called BibiWiper... The wiper encrypted files on the hard disk before overwriting the master boot record (MBR) and crashing the computer.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
The impact tier is the most varied; Shamoon 4.0, Meteor, BibiWiper, and MuddyViper represent the confirmed destructive payload suite. IOCONTROL directly targets IoT and fuel management OT systems. BaqiyatLock and Sicarii deploy pseudo-ransomware designed to destroy data rather than hold it for ransom.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A destructive wiper included in the confirmed payload suite and noted as pre-staged by Druidfly/Homeland Justice/Karma.
A wiper used by Druidfly against Israeli targets. It encrypts files, overwrites the master boot record, and renders systems unbootable.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.