BiBiGun

Executive Summary

BiBiGun is a pro-Hamas hacktivist group known for developing wiper malware targeting Israeli systems. Their primary activity involves deploying BiBi-Linux and BiBi-Windows malware to corrupt and delete data, with no evidence of data theft. The group's tactics resemble those of Moses Staff, suggesting potential Iranian influence.

Goals & Targeting

BiBiGun's objectives are likely aligned with Hamas' geopolitical agenda, targeting Israeli entities to disrupt and damage critical infrastructure. Their specific targeting of sectors under Hamas influence, such as energy and communications, indicates a strategic focus on undermining Israeli stability and sovereignty. The group's operational choices, focusing on data destruction rather than theft, suggest a long-term disruption strategy.

BiBiGun is a notorious hacktivist group advocating for Hamas, conducting cyberattacks primarily against Israeli targets. They gained prominence through their development of wiper malware, including BiBi-Linux and BiBi-Windows, designed to erase critical data from infected systems. While their methods resemble ransomware, they do not demand payment or exfiltrate data, focusing solely on destruction. The group's activities align with broader hacktivist goals against Israel, mirroring techniques used by Moses Staff, which is linked to Iran. This suggests BiBiGun may have state-sponsored ties or operational sympathies with such groups.

Key Capabilities

• Development of wiper malware (BiBi-Linux and BiBi-Windows)
• Spear-phishing attacks
• Targeted supply chain compromises
• Persistent lateral movement within networks

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

BiBiGun has been involved in several campaigns targeting Middle Eastern sectors, particularly Israel. Their operations demonstrate a pattern of focusing on high-value targets within energy, telecom, and government sectors. Campaigns often involve extensive lateral movement and persistence mechanisms, suggesting a patient approach to maximize damage.

IOC Patterns

• Spear-phishing emails with malicious attachments (e.g., 'Diplomatic Communication')
• Presence of BiBi-Linux/BiBi-Windows malware artifacts on systems
• Network traffic anomalies from C2 domains
• File deletion patterns in targeted directories

Recommended Actions

• Monitor for known IOCs related to wiper malware activity.
• Implement robust backup and disaster recovery plans for critical systems.
• Conduct regular security audits and incident response drills focusing on data integrity.
• Block execution of untrusted scripts and limit privilege escalation vectors.

Suggested Tags