AcidRain

MITRE ATT&CK: S1125 View on attack.mitre.org

Aliases: AcidRain

First seen
2022-02-24 00:00:00
Malware type
wiper
Family
Malware family
Operating systems
network-devices, linux
Related IoCs
1 (1 malicious)
Last IoC activity
2025-09-30 15:35:43
Profile updated
2026-07-07 14:21:34

Targeted industries: technology-and-telecommunications government-and-public-sector

Targeted regions: country_code:ua

Context

AcidRain is an ELF binary targeting modems and routers using MIPS architecture. AcidRain is associated with the ViaSat KA-SAT communication outage that took place during the initial phases of the 2022 full-scale invasion of Ukraine. Analysis indicates overlap with another network device-targeting malware, VPNFilter, associated with Sandworm Team. US and European government sources linked AcidRain to Russian government entities, while Ukrainian government sources linked AcidRain specifically to Sandworm Team.

Recent IoC activity

1 malicious indicator in Maltiverse are attributed to AcidRain (S1125). The 1 most recently updated:

TypeIndicatorUpdatedSources
URL http://141.105.71.82/Account/Login 2025-09-30 1

Detection coverage

  • 1 YARA rules
  • 50 Sigma rules

Malware & tools used

  • System Shutdown/Reboot (attack-pattern)
  • Data Destruction (attack-pattern)
  • Disk Content Wipe (attack-pattern)
  • File and Directory Discovery (attack-pattern)

Used by threat actors

Detection rules

  • DITEKSHEN_MALWARE_Win_Acridrain (yara-rule)

Reports & references

  • trellix.com — Pouring Acid Rain (report)
  • malpedia.caad.fkie.fraunhofer.de — Elf.Acidrain (report)
  • cybersecurity.att.com — Analysis On Recent Wiper Attacks Examples And How They Wiper Malware Works (report)
  • bleepingcomputer.com — Viasat Confirms Satellite Modems Were Wiped With Acidrain Malware (report)
  • techtimes.com — Viasat Hit Russia S Wiper Malware Called Acidrain Affecting European (report)
  • trustwave.com — Overview Of The Cyber Weapons Used In The Ukraine Russia War (report)
  • cybersecuritynews.com — Acidrain Wiper Malware (report)
  • reversemode.com — Viasat Incident From Speculation To (report)
  • splunk.com — Threat Update Acidrain Wiper (report)
  • fortinet.com — The Increasing Wiper Malware Threat (report)
  • splunk.com — Strt Ta03 Cpe Destructive Software (report)
  • youtube.com — Watch (report)
  • sentinelone.com — Acidrain A Modem Wiper Rains Down On Europe (report)
  • MITRE ATT&CK — S1125 (report)
  • cyberscoop.com — Viasat Malware Wiper Acidrain (report)
  • state.gov — Attribution Of Russias Malicious Cyber Activity Against Ukraine (report)

External references