BibiWiper
BibiWiper is a destructive wiper malware associated in the provided content with Iranian-aligned activity. It is described as part of a confirmed destructive payload suite alongside Shamoon 4.0, Meteor, and MuddyViper. The content states that Druidfly reappeared in 2023 targeting Israel with this wiper, and that the name likely references Israeli Prime Minister Benjamin Netanyahu’s nickname, “Bibi.” High-confidence details in the content are limited to its destructive role, its use against Israeli targets, and its association with Druidfly. No specific infection vector, technical behavior, platform details, or indicators of compromise are provided in the source content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Druidfly reappeared in 2023, when it began targeting Israel with a wiper called BibiWiper, seemingly named after Israeli Prime Minister Benjamin Netanyahu, whose nickname is “Bibi”.
The wiper deployed in these attacks was called BibiWiper... The wiper encrypted files on the hard disk before overwriting the master boot record (MBR) and crashing the computer.
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Persistence
1 techniqueDruidfly, also known as Homeland Justice and Karma, maintains BibiWiper capability pre-staged with HTTPSnoop malware, AnyDesk, ScreenConnect, and ReGeorg web shells as a recognisable pre-destructive indicator chain.
Credential Access
1 techniqueThe wiper was signed with a legitimate certificate, which was probably stolen.
Discovery
1 technique“The wiper… overwriting the master boot record (MBR) and crashing the computer.”
Impact
3 techniquesThe impact tier is the most varied; Shamoon 4.0, Meteor, BibiWiper, and MuddyViper represent the confirmed destructive payload suite. IOCONTROL directly targets IoT and fuel management OT systems. BaqiyatLock and Sicarii deploy pseudo-ransomware designed to destroy data rather than hold it for ransom.
The wiper encrypted files on the hard disk before overwriting the master boot record (MBR) and crashing the computer.
The wiper encrypted files on the hard disk before overwriting the master boot record (MBR) and crashing the computer.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A destructive wiper included in the confirmed payload suite and noted as pre-staged by Druidfly/Homeland Justice/Karma.
A wiper used by Druidfly against Israeli targets. It encrypts files, overwrites the master boot record, and renders systems unbootable.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.