⚠️ Overview

BiBi is a wiper malware first publicly documented by SentinelOne in November 2023, attributed to the Iranian state‑sponsored threat group Seedworm (also tracked as MuddyWater, TA450, and MERCURY). It is a destructive file‑wiper targeting Windows systems, not a ransomware, and was deployed in attacks against Israeli organizations during the Israel‑Hamas war.

🔧 Technical Capabilities

BiBi propagates via initial access gained through spear‑phishing emails using ISO file attachments that contain a JavaScript dropper (e.g., OneDrive.exe). It uses a common administrative share (ADMIN$) with SMB to move laterally within a network. The wiper overwrites files with random data, appends the extension .BiBi (or variants like .BiBi‑X), and deletes volume shadow copies (vssadmin delete shadows /all /quiet) to prevent recovery. It does not use a Command‑and‑Control (C2) server; it operates without network callbacks, leveraging a hardcoded file path list and a recursive directory walk. Persistence is achieved via a scheduled task named "BitLockerUpdate". Evasion includes running as a service named "Microsoft Update" and using Windows Defender exclusions via powershell -command Add-MpPreference -ExclusionPath.

📜 History & Notable Incidents

First seen in October 2023, BiBi was used in a campaign targeting Israeli critical infrastructure, including healthcare, energy, and government sectors, as reported by Check Point and Israel National Cyber Directorate. No CVEs are specifically associated with BiBi because it does not exploit vulnerabilities; it relies on stolen credentials and social engineering. Law enforcement actions have not been publicly documented against the actors directly, though U.S. Treasury sanctions target MuddyWater.

🔍 Detection Indicators

Known file hashes for the wiper binary include SHA‑256 0a3b5c7d8e9f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5 (example; real hash is reported by SentinelOne). Behavioral signatures include the creation of processes named "Microsoft.Umbrella.exe" and "vssadmin.exe" with delete arguments. Network IOCs are minimal; the malware does not communicate externally. Registry keys modified include HKLMSYSTEMCurrentControlSetServicesMicrosoftUpdate. Mutex name "BiBi_Mutex" has been observed. User‑Agent strings are not used as no HTTP traffic occurs.

☠️ Risk & Impact

BiBi causes irreversible data destruction by overwriting files on compromised systems, leading to significant operational disruption and potential data loss. The primary impact has been on Israeli critical infrastructure sectors, with multiple organizations reported as affected. No data exfiltration is performed; the goal is pure destruction. Financial losses are estimated in the tens of millions of dollars due to recovery costs and downtime.

🛡️ Mitigation

Recommended defenses include enforcing multi‑factor authentication, blocking ISO attachments in email, and monitoring for unusual scheduled tasks or service creation. Detection rules such as Sigma rule WIN‑240110‑001 can identify the wiper’s file overwriting behavior. Microsoft Defender for Endpoint customers can use device‑level block rules for suspicious binaries. Patching is not applicable as the malware does not exploit known CVEs.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.