Pro-Hamas Hacktivists Targeting Israeli Entities with Wiper Malware

A pro-Hamas hacktivist team has been noticed making use of a new Linux-based wiper malware dubbed BiBi-Linux Wiper, focusing on Israeli entities amidst the ongoing Israeli-Hamas war.

“This malware is an x64 ELF executable, lacking obfuscation or protective actions,” Security Joes mentioned in a new report printed nowadays. “It will allow attackers to specify target folders and can possibly destroy an total operating procedure if run with root permissions.”

Some of its other capabilities include multithreading to corrupt documents concurrently to boost its pace and arrive at, overwriting data files, renaming them with an extension containing the hard-coded string “BiBi” (in the structure “[RANDOM_NAME].BiBi[NUMBER]”), and excluding selected file forms from getting corrupted.

“When the string “bibi” (in the filename), may surface random, it holds sizeable indicating when combined with matters such as politics in the Middle East, as it is a prevalent nickname utilised for the Israeli Prime Minister, Benjamin Netanyahu,” the cybersecurity company additional.

The damaging malware, coded in C/C++ and carrying a file dimension of 1.2 MB, makes it possible for the risk actor to specify goal folders through command-line parameters, by default opting for the root listing (“https://thehackernews.com/”) if no route is delivered. Nevertheless, undertaking the action at this level necessitates root permissions.

One more notable component of BiBi-Linux Wiper is its use of the nohup command during execution so as to operate it unimpeded in the qualifications. Some of the file varieties that are skipped from getting overwritten are people with the extensions .out or .so.

“This is since the danger depends on data files such as bibi-linux.out and nohup.out for its procedure, together with shared libraries vital to the Unix/Linux OS (.so information),” the enterprise said.

The improvement will come as Sekoia revealed that the suspected Hamas-affiliated menace actor identified as Arid Viper (aka APT-C-23, Desert Falcon, Gaza Cyber Gang, and Molerats) is probable arranged as two sub-groups, with every cluster focused on cyber espionage functions versus Israel and Palestine, respectively.

“Targeting individuals is a widespread apply of Arid Viper,” SentinelOne scientists Tom Hegel and Aleksandar Milenkoski said in an examination unveiled final 7 days.

“This incorporates pre-selected Palestinian and Israeli significant-profile targets as very well as broader groups, normally from critical sectors these kinds of as protection and governing administration corporations, legislation enforcement, and political functions or actions.”

Attack chains orchestrated by the group include social engineering and phishing attacks as preliminary intrusion vectors to deploy a extensive wide variety of tailor made malware to spy on its victims. This includes Micropsia, PyMicropsia, Arid Gopher, and BarbWire, and a new undocumented backdoor called Rusty Viper that’s published in Rust.

“Collectively, Arid Viper’s arsenal supplies various spying capabilities this sort of as recording audio with the microphone, detecting inserted flash drives and exfiltrating data files from them, and thieving saved browser qualifications, to name just a couple,” ESET mentioned previously this month.

Identified this article interesting? Stick to us on Twitter  and LinkedIn to go through additional exclusive content material we publish.

Some parts of this article are sourced from:
thehackernews.com