Wiped Out: Unmasking the Arid Viper Tactics Behind BiBi Malware

Background

BiBi Wiper surfaced at the end of October 2023. Security Joes documented a Linux variant (BiBi-Linux) and BlackBerry found a Windows variant (BiBi-Windows) a day later. The Windows build was a ~203 KB x64 PE compiled with Visual Studio 2019 on 21 October 2023. It enumerates the file system, overwrites files with random bytes using multiple threads for speed, deliberately skips .exe, .dll and .sys so the operating system keeps running, and renames what it destroys with a .BiBi extension. The Linux variant, an unobfuscated x64 ELF, can wipe an entire system when run as root. The goal is disruption and psychological impact, not profit; there is no ransom and no recovery.

Attribution is disputed, and this matters for accuracy. Security Joes linked the activity to a pro-Hamas hacktivist persona calling itself Karma, noting tactical overlaps with Moses Staff (aka Cobalt Sapling), an actor suspected to be of Iranian origin. Palo Alto Networks Unit 42 assessed the wiper activity as the work of an Iranian-backed APT it tracks as Agonizing Serpens (also Agrius, BlackShadow, Pink Sandstorm, DEV-0022). Notably, neither points to Gaza Cybergang / Molerats. That name refers to Arid Viper (APT-C-23), a separate Hamas-aligned cyber-espionage cluster, so the family label attached to this sample is almost certainly a misattribution.

One more correction before the technical read. The export is internally inconsistent: the header asserts ‘Gaza Cyber Gang AKA Molerats’ while the Analysis Snapshot says ‘No family confidently matched.’ When an automated report disagrees with itself, the conservative reading wins, no confident family, which is exactly how we treat it below.

What we observed

What this sample actually showed, versus what BiBi is known to do:

• Rated only SUSPICIOUS: the engine scored the 312 KB PE 70/100 and did not classify it MALICIOUS, a notable step down from a confirmed wiper, and it matched no family.
• No destruction observed: none of the defining wiper behaviours (mass file overwrite, .BiBi renaming, inhibiting recovery, disk or data destruction) were recorded in this run. For a wiper, absence of destruction evidence is the headline.
• Heavy anti-analysis instead: 74 signatures fired, almost all evasion, debugger detection (IsDebuggerPresent, SEH tricks, OutputDebugString), WMI VM fingerprinting, sandbox-uptime and extended-sleep checks, and analysis-tool detection. The real BiBi-Windows wiper is comparatively straightforward, so a heavily armoured sample is a behavioural mismatch worth flagging.
• Discovery and loading tradecraft: the evidenced techniques were file/directory and system-information discovery, DLL side-loading and access-token manipulation, consistent with a loader, dropper or evasive stager rather than a proven destructive payload.
• Size and profile mismatch: at 312 KB this does not match the documented ~203 KB BiBi-Windows build, another reason not to assert this is BiBi without more evidence.
• What would confirm it: sandbox capture of mass file overwrite with random data, the exe/dll/sys skip logic, or the .BiBi rename. Detonate in an isolated VM with file-system monitoring before publishing any BiBi attribution.

BiBi Wiper destruction flow (documented family behaviour)

This is what a confirmed BiBi execution looks like, not what this sample was observed doing. It skips exe/dll/sys so the machine still boots and the victim sees the damage.

Attribution

For the BiBi family, confidence is high that it is a destructive, geopolitically motivated wiper; the actor is contested between a pro-Hamas hacktivist front (Karma, per Security Joes) and an Iranian-nexus APT (Agonizing Serpens / Agrius, per Unit 42). The Gaza Cybergang / Molerats label in this report is not supported by public reporting and conflicts the report’s own ‘no family matched’ line, so we reject it. For this specific sample, confidence that it is BiBi is low: SUSPICIOUS verdict, no family match, no observed destruction, size mismatch. The ATT&CK entries below separate what was evidenced on the sample from the techniques that define the BiBi family.

Confidence: 55%.

A wiper that never wiped, pinned on a group the engine could not match. When the sample and the label disagree, trust the evidence.

Tactics, techniques & procedures (MITRE ATT&CK)

Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:

Indicators of compromise

Defenders can block or hunt the following:

Detection

Copy-ready hunting query:

# BiBi wiper detection + this sample's evasive behaviour
# 1) Wiper behaviour (what a REAL BiBi execution looks like) -- highest priority
index=edr file_event=rename (file_name="*.BiBi") OR (file_event=modify NOT file_name IN ("*.exe","*.dll","*.sys")) | stats dc(file_path) as files by host, process | where files > 300
# 2) Inhibit-recovery / destruction pre-steps
index=edr (process_name IN ("vssadmin.exe","wbadmin.exe","bcdedit.exe")) (command_line="*delete*" OR command_line="*recoveryenabled no*")
# 3) This sample's anti-analysis cluster (debugger/VM/sandbox/uptime)
index=edr (api_call IN ("IsDebuggerPresent","OutputDebugString") OR wmi_query="*Win32_ComputerSystem*Model*" OR behavior="long_sleep_before_activity" OR behavior="analysis_tool_check")
# 4) DLL side-loading + token manipulation
index=edr (technique IN ("T1574.002","T1134"))
# 5) Known hashes for THIS sample (labelled BiBi; not confirmed)
index=edr (sha256="96f3aee2040c2075440dcce39c16f90ea9f5649061a86f51fb9c5baff4c5333d" OR md5="5511c74b4d4776519a351e062acd6a15")
#
# Reminder: this sample scored SUSPICIOUS, matched no family and showed no wiping.
# Detonate in an isolated VM with file-system monitoring before calling it BiBi.

Recommendations

• Prepare for wipers, not just ransomware: keep offline, immutable, tested backups and a rebuild-from-bare-metal plan, because a wiper offers no decryptor and recovery speed is everything.
• Detect the destruction pattern: alert on rapid mass file modification, on any .BiBi renaming, and on shadow-copy or backup-catalog deletion, these fire on a real BiBi run regardless of attribution.
• Do not over-attribute this sample: it is SUSPICIOUS, family-unmatched and showed no wiping, and the Gaza Cybergang / Molerats label conflicts the report itself, so treat BiBi attribution as unconfirmed and correct the record.
• Confirm before you publish: detonate the hash in an isolated VM with file-system and API monitoring, and only call it BiBi if you observe the overwrite, the exe/dll/sys skip, or the .BiBi rename.
• Reduce the blast radius: enforce least privilege and phishing-resistant MFA (wipers need to run elevated and spread), segment critical systems, and protect against DLL side-loading and token abuse, the tradecraft this sample actually showed.