Bibi Wiper

The BiBi wiper is a custom malware developed and utilized by the cyber threat group, Void Manticore. This malicious software, named after Israeli Prime Minister Benjamin Netanyahu's nickname "BiBi," is used to disrupt computer operations, exfiltrate email data, and in some instances, hold data for ransom. The group first gained significant public attention when it was linked to the BiBi wiper attacks in Israel from 2023-2024. During these operations, Void Manticore demonstrated not just an intent to cause direct damage but also to send politically charged messages. The group's operations extend beyond Israel, with similar attacks observed in Albania in late 2023 and early 2024. Void Manticore used partition wipers akin to those deployed in Israel as part of the BiBi wiper attacks. The file name of this wiper was bibi-linux.out, and the extensions of the wiped files were “.BiBi”. Interestingly, BiBi Wiper doesn’t infect files with the extensions “.out” and “.so”, likely because it relies on files with those extensions and other libraries essential for the OS and to keep the process running. Two actors have been identified within the group, both using different tools and access methods. Actor #1, known as Storm-0861 or Scarred Manticore, used tools such as Foxshell and Liontail to gain initial access via CVE-2019-0604, with the objective of email exfiltration. Actor #2, known as Storm-0842 or Void Manticore, then utilized the access provided by Actor #1 to deploy wipers and ransomware, including the BiBi Wiper. This coordinated approach and the use of politically symbolic malware names underscore the sophistication and potential geopolitical motivations of Void Manticore's operations.