BiBiGun · Threat actors

A pro-Hamas hacktivist group developed a wiper called BiBi-Linux to target and destroy data on Israeli systems. The malware impersonates ransomware but operates solely to corrupt and delete files, indicating no data theft. A Windows variant, BiBi-Windows, was also discovered, sharing similarities with BiBi-Linux but targeting all files except executables. ESET researchers have named the group behind the wipers BiBiGun. The group's TTPs have shown overlaps with Moses Staff, which is believed to have an Iran nexus.

The group's reported origin is Palestinian Territories.

Published reports on this actor:

Source: MISP Galaxy, Malpedia.

What does a hacktivist do?

Hacktivist groups choose targets based on political and current events. Denial-of-service (DDoS) attacks, website defacements and publication of stolen data are common; announcements are made on Telegram channels.

Which defenses matter most?

Use denial-of-service protection and a content delivery network for your website and APIs.
Keep your content management system and plugins updated, and do not expose the admin panel to the internet.
Monitor announcement channels: target lists are shared before attacks.

Is your organization mentioned?

Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.

Search your domain

Threat Intelligence