Israel has been victimized in a phishing campaign that has been delivering Windows and Linux data wipers to devices. The campaign is believed to be perpetrated by pro-Hamas hacktivists and other Iranian-backed actors. The Israel Nation Cyber Directorate, a government organization dedicated to protecting Israeli cyber assets, released a report detailing how a phishing campaign impersonated a cloud security company. The email message describes a supposed zero-day vulnerability for F5 BIG-IP devices. It then urges the victim to download and install the update, which comes in the form of “F5Updater.exe” for Windows and “update.sh” for Linux. The Windows version of the executable creates a fake F5 security update with the F5 logo on the screen to further impersonate F5 and convince the victim that the software is legitimate. This pop up contains a clickable button that when clicked sends a message with device information to a Telegram channel after which it will attempt to wipe all data from the device. The Linux version works slightly differently, first trying to remove all users from the device using the Linux “wipe” command to remove all of the operating system files and the different partitions that may exist. After these commands are run, the device will restart which implements all of the changes made. BleepingComputer reports that the pro-Palestinian hacking group Handala has admitted responsibility for the attack campaign, but this remains unconfirmed as of December 21, 2023. CTIX analysts will continue to monitor newly discovered hacking campaigns that originate from the Middle East.