Hatef

Hatef is a Windows wiper malware family associated with the Handala Hack Team, a pro-Palestinian hacktivist-branded cluster that multiple security firms assess as linked to Iranian state activity, including reporting tying the broader cluster to MOIS and overlap with Void Manticore / Storm-0842 / BANISHED KITTEN / Dune. It is described as a .NET-based wiper for Windows and is repeatedly referenced alongside the Linux wiper Hamsa and other Handala-linked destructive malware including BiBi Wiper, Cl Wiper, CoolWipe, ChillWipe, and Handala Wiper.

High-confidence reporting in the content ties Hatef to phishing-led destructive campaigns, including Operation HamsaUpdate targeting Israeli organizations via F5 BIG-IP vulnerability-themed lures. In that campaign, administrators were instructed to execute a ZIP-delivered Windows loader masquerading as an F5 update utility. The initial loader, a C# executable named F5UPDATER.EXE, extracted an embedded resource named Hatef.exe from the archive and executed it from System32. One documented loader sample had SHA-256 fe07dca68f288a4f6d7cbd34d79bb70bc309635876298d4fde33c25277e30bd2. Another related loader sample, SHA-256 ca9bf13897af109cb354f2629c10803966eb757ee4b2e468abc04e7681d0d74a, contained both Hatef.exe and Handala.exe resources, with Handala.exe acting as a Delphi second-stage loader.

Behaviorally, Hatef performs a singleton check, verifies Administrator privileges, and uses a fake updater message box to prompt elevation. It recursively overwrites files with 4096-byte blocks of random data and then deletes them. Reported target paths include Users, Program Files, Program Files (x86), and Windows across connected drives. The malware reports execution status to a Telegram chat, including the victim external IP address, hostname, timestamp, and counts of undeleted files. The same reporting infrastructure was also used by the paired Linux Hamsa variant; published indicators include Telegram Bot ID 6428401585:AAGE6SbwtVJxOpLjdMcrL45gb18H9UV7tQA and chat/channel ID 6932028002.

The content characterizes Hatef as part of a broader evolution in Iranian disruptive operations toward cross-platform destructive capability. Hatef is specifically identified as the Windows component of a Windows/Linux wiper set, while Hamsa and BiBi are described as Bash-based Linux wipers. Across reporting, Handala is said to deploy Hatef in attacks and to gain initial access through social engineering and phishing, including impersonation of legitimate organizations and exploitation of major security incidents such as the CrowdStrike outage as lure material. Hatef has been publicly linked to campaigns targeting Israeli organizations and is also cited in reporting on Handala activity affecting Western targets, including the Stryker incident context, although some later disruptive operations were assessed as potentially relying on abuse of legitimate management tooling rather than traditional malware deployment.