Acidrain

AcidRain is a malicious software, or malware, that was first described in March, following a cyberattack that disrupted approximately 10,000 satellite modems associated with communications provider Viasat's KA-SAT network. The malware was discovered by cybersecurity firm SentinelOne in February 2022. AcidRain specifically targeted Viasat KA-SAT modems, affecting tens of thousands of them, and even causing spillover outside of Ukraine. It gained access through a poorly configured VPN in the remote-management network and delivered destructive payloads. Notably, AcidRain was one of at least 15 distinct wipers reported by Trellix to be used by Russian forces during the conflict. The AcidRain wiper campaign was part of a broader strategy by Russian actors against Ukrainian targets, particularly after the onset of the war between the two countries. This malware permanently disabled tens of thousands of Viasat KA-SAT satellite communications network consumer broadband modems. AcidRain shares notable similarities with other wipers such as AcidPour and VPNFilter, a modular attack platform linked to Sandworm by the US Department of Justice. SentinelOne found AcidPour's IOCTL-based wiping mechanism to be the same as the wiping mechanism in AcidRain and VPNFilter. Despite its effectiveness, AcidRain is considered less sophisticated compared to other wipers like AcidPour. For example, AcidRain excessively uses process forking and unwarranted repetition of certain operations, indicative of its overall sloppiness. However, the new wiper, AcidPour, includes features for use against a significantly broader range of targets than AcidRain, according to researchers at SentinelOne who discovered the threat. This shows an evolution in the sophistication and scope of these types of attacks.