Loading story…
Pro-Hamas hacktivist activity targeting Israeli entities has expanded from disruptive website attacks to destructive malware, with researchers linking multiple campaigns to wiper operations designed to render systems unusable. Reports on BiBi Wiper said the malware was deployed in the context of the Israel-Hamas war and evolved from Linux-focused variants to a Windows version, broadening the range of systems at risk. The malware was described as overwriting files and damaging hosts rather than stealing data, underscoring an intent to disrupt operations and create visible impact.
Separate research on Handala described another wiper campaign aimed at Israeli targets, reinforcing a pattern of politically motivated destructive attacks against organizations in the country. Together, the reporting indicates that pro-Hamas-aligned actors are using wipers as a core tactic against Israeli networks, with malware families including BiBi Wiper and Handala adapted for different environments and used to sabotage systems, interrupt business activity, and amplify the conflict in cyberspace.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Trellix released research describing a wiper used by the Handala group against Israeli targets, adding technical detail on a destructive malware campaign associated with anti-Israel operations. The reference indicates continued wiper-focused activity against Israel by a named threat actor.
Security reporting revealed that the BiBi wiper had expanded to a Windows variant, indicating the malware family was adapted beyond Linux systems for attacks on Israeli targets. The reporting tied the activity to the same broader pro-Hamas hacktivist campaign.
A Linux-based wiper dubbed BiBi-Linux was used in attacks against Israeli entities in the context of the Israel-Hamas war. Researchers linked the malware to pro-Hamas hacktivist activity targeting Israeli organizations.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
trellix.com
Open sourcearcticwolf.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Handala Hack**, an online persona tied to **Void Manticore** and assessed by multiple researchers as linked to Iran’s **Ministry of Intelligence and Security (MOIS)**, is being tracked for destructive intrusions involving **wiper attacks** and related hack-and-leak activity against organizations in **Israel** and the **United States**. Public reporting cited by Unit 42 says attackers gained access to corporate networks using legitimate user credentials, while recent tradecraft includes phishing, identity compromise, and abuse of administrative access through **Microsoft Intune**. Israel’s National Cyber Directorate warned that several incidents involved deletion of servers and workstations to disrupt operations, reinforcing concern that the current regional conflict is increasing the likelihood of further destructive cyber activity. Technical reporting indicates the actor continues to favor **hands-on-keyboard** operations, multiple wiping methods, and a mix of custom and publicly available tooling. Check Point said newly observed techniques include use of **NetBird** for tunneling and an **AI-assisted PowerShell** script for wiping, while Blackpoint’s advisory highlighted a broader Iranian threat posture featuring credential theft, phishing, password spraying, remote management tools, and exfiltration utilities such as **Rclone**. The combined reporting points to a near-term risk of disruptive attacks focused on identity compromise, lateral movement, data theft, and system destruction, particularly for organizations with exposed services, weak privilege controls, or insufficiently protected administrative accounts.
Jun 29, 2026
Hacktivist groups rapidly turned the Israel-Hamas war into a parallel cyber conflict, launching **DDoS attacks, website defacements, data leak claims, and disruptive messaging operations** against media outlets, government sites, private companies, and public-facing services. Reports said the *Jerusalem Post* suffered outages, the Israeli **Red Alert** missile warning app was targeted, and broader campaigns such as **`#OpIsrael`** and **`OpsRise`** mobilized pro-Palestinian, pro-Russian, and other aligned actors against Israeli targets. Researchers also noted retaliatory activity by pro-Israel groups against Palestinian entities, while spillover attacks hit organizations in countries seen as backing one side or the other. The activity extended beyond websites into physical and operational systems. Attackers reportedly hijacked Israeli smart billboards to display pro-Hamas messages, while analysts warned that opportunistic actors were probing critical infrastructure and operational technology tied to **power, water, fuel, and ISP networks**. Cybersecurity firms and news outlets described the campaign as dominated by loosely coordinated hacktivist collectives, with pro-Palestinian groups outnumbering pro-Israel actors and some cybercriminals joining the fray. At the same time, the Israel-linked group **Predatory Sparrow** resurfaced amid the fighting, underscoring concerns that more capable state-aligned or advanced threat actors could deepen the conflict's cyber dimension.
Jun 29, 2026
Researchers linked **Handala Hack** to Iran’s Ministry of Intelligence and Security as part of the broader **Void Manticore** cluster, describing a coordinated campaign that targeted organizations in Israel, Albania, and the United States with disruptive and destructive intrusions. Reported victims and incidents included attacks on **Stryker**, compromises affecting kindergarten emergency alert systems, and a personal Gmail breach publicly attributed to FBI Director Kash Patel that the FBI said involved historical, non-classified data. U.S. authorities also seized four domains allegedly used by the operation to leak stolen data, publicize attacks, and support influence activity. Investigators said the intrusions commonly began with **compromised VPN credentials**, followed by hands-on-keyboard movement over **RDP**, use of **NetBird** for tunneling, credential theft, Active Directory reconnaissance, and staged malware delivery. The destructive phase combined multiple methods at once, including a custom **Handala Wiper**, **PowerShell-based wiping**, **VeraCrypt** encryption, manual deletion of files and virtual machines, and tooling tied to webshell persistence, Telegram-linked data exfiltration, driver-assisted disk access, and attempts to disable endpoint defenses. Analysts also tied Handala to other MOIS personas including **Homeland Justice** and **Karma**, saying the fronts shared infrastructure, domain patterns, Telegram-based communications, and overlapping tradecraft in a single coordinated state-backed campaign.
Jun 29, 2026