Cybersecurity researchers have warned about a Windows version of a wiper malware that was previously observed targeting Linux systems in cyber attacks aimed at Israel.
Dubbed BiBi-Windows Wiper by BlackBerry, the wiper is the Windows counterpart of BiBi-Linux Wiper, which has been put to use by a pro-Hamas hacktivist group in the wake of the Israel-Hamas war last month.
Slovak cybersecurity firm is tracking the actor behind the wiper under the name BiBiGun, noting that the Windows variant (bibi.exe) is designed to overwrite data in the C:\Users directory recursively with junk data and append “.BiBi” to the filename.
The BiBi-Windows Wiper artifact is said to haveeen compiled on October 21, 2023, two weeks after the onset of the war. The exact method by which it is distributed is currently unknown.
The development comes as Security Joes, which first documented BiBi-Linux Wiper, said the malware is part of a “larger campaign targeting Israeli companies with the deliberate intent to disrupt their day-to-day operations using data destruction.”
The cybersecurity firm said it identified tactical overlaps between the hacktivist group, who call themselves Karma, and another geopolitically motivated actor codenamed Moses Staff (aka Cobalt Sapling), which is suspected to be of Iranian origin.
“Although the campaign has primarily centered around Israeli IT and government sectors up to this point, some of the participating groups, such as Moses Staff, have a history of simultaneously targeting organizations across various business sectors and geographical locations,” Security Joes said.
Source: https://thehackernews.com/
