MITRE ATT&CKsoftware (malware)

S1167 AcidPour

Published 2024-11-25 Modified 2025-04-17 Official page ↗
Domain
enterprise
Platforms
Linux
Version
1.0
Created
2024-11-25

Description

AcidPour is a variant of AcidRain designed to impact a wider range of x86 architecture Linux devices. AcidPour is an x86 ELF binary that expands on the targeted devices and locations in AcidRain by including items such as Unsorted Block Image (UBI), Deice Mapper (DM), and various flash memory references. Based on this expanded targeting, AcidPour can impact a variety of device types including IoT, networking, and ICS embedded device types. AcidPour is a wiping payload associated with the Sandworm Team threat actor, and potentially linked to attacks against Ukrainian internet service providers (ISPs) in 2023.

Related

Uses · MITRE ATT&CK (7)

  • T1561.001 Disk Content Wipe sub-technique
  • T1070.004 File Deletion sub-technique
  • T1529 System Shutdown/Reboot technique
  • T1485 Data Destruction technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1120 Peripheral Device Discovery technique

Referenced by MITRE ATT&CK · uses (1)

  • G0034 Sandworm Team group

References