AcidPour Wiper Deployed Against Ukrainian Targets
Researchers have discovered previously unseen wiper malware associated with Russia, which was used in an operation over two years ago targeting more than 10,000 satellite modems primarily in Ukraine just before Russia's invasion of the neighboring country.
Named AcidPour by security firm Sentinel One, this new malware bears striking resemblances to AcidRain, a wiper identified in March 2022, confirmed by Viasat to have been involved in the attack on its modems earlier that month. Wipers are malicious programs designed to destroy data or render devices unusable. Viasat reported AcidRain being installed on over 10,000 Eutelsat KA-SAT modems after attackers breached the company's private network.
Similarities Between AcidPour and VPNFilter
Sentinel One, the same firm that discovered AcidRain, noted technical similarities between it and a malware attributed to the Russian government in 2018, known as VPNFilter. This connection suggests AcidRain and the 2018 malware might be products of the same developer team. The recent discovery of AcidPour further supports this, indicating it was likely developed by the Kremlin-affiliated team.
Technical parallels between AcidPour and other malware, such as their reboot mechanism, recursive directory wiping logic, and wiping mechanism based on IOCTL, further reinforce this association. AcidPour also shares programming characteristics with other malware attributed to the Sandworm group, including Industroyer2 and CaddyWiper, both of which targeted Ukrainian infrastructure.
The programming language and techniques used in AcidPour align with those employed in previous Sandworm-related attacks, indicating a consistent modus operandi. Ukrainian authorities link AcidPour to UAC-0165, a splinter group associated with Sandworm, known for its history of targeting Ukrainian critical infrastructure.
Speculation from Sentinel One researchers suggests AcidPour may have been deployed to disrupt Ukrainian telecommunications networks, which have been offline since March 13, shortly before the discovery of the new wiper.
