MITRE ATT&CKsoftware (malware)
S1125 AcidRain
- Domain
- enterprise
- Platforms
- Network Devices, Linux
- Version
- 1.1
- Created
- 2024-03-25
Description
AcidRain is an ELF binary targeting modems and routers using MIPS architecture. AcidRain is associated with the ViaSat KA-SAT communication outage that took place during the initial phases of the 2022 full-scale invasion of Ukraine. Analysis indicates overlap with another network device-targeting malware, VPNFilter, associated with Sandworm Team. US and European government sources linked AcidRain to Russian government entities, while Ukrainian government sources linked AcidRain specifically to Sandworm Team.
Related
Uses · MITRE ATT&CK (4)
Referenced by MITRE ATT&CK · uses (1)
- G0034 Sandworm Team group
References
- https://cyberscoop.com/viasat-malware-wiper-acidrain/ Vincens AcidPour 2024
- https://www.state.gov/attribution-of-russias-malicious-cyber-activity-against-ukraine/ AcidRain State Department 2022
- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ AcidRain JAGS 2022