"Beware of BiBi Wiper: A Cross-Platform Threat Targeting Windows and Linux"

Israeli organizations are being targeted by data-wiping attacks using variants of the BiBi malware family, which can destroy data on both Linux and Windows systems. The attacks are part of a larger cyber offensive targeting Israeli organizations, particularly in the education and technology sectors. The Israeli CERT has published rules to help organizations identify and prevent these attacks, and recommends using provided identifiers for corporate security systems. Researchers have linked the attacks to an Iranian-backed APT group. The BiBi malware overwrites files without exfiltration, encryption, or ransom demands, and targets all file types except for .EXE, .DLL, and .SYS files. It also deletes system snapshots and disables recovery features. The initial infection vector remains unknown.