AcidRain
- ID
- S1125
- Type
- Malware
- Platforms
- Network Devices, Linux
- Source
- attack.mitre.org
- MITRE last modified
- 16 Apr 2025
AcidRain is an ELF binary targeting modems and routers using MIPS architecture.[1] AcidRain is associated with the ViaSat KA-SAT communication outage that took place during the initial phases of the 2022 full-scale invasion of Ukraine. Analysis indicates overlap with another network device-targeting malware, VPNFilter, associated with Sandworm Team.[1] US and European government sources linked AcidRain to Russian government entities, while Ukrainian government sources linked AcidRain specifically to Sandworm Team.[2][3]
Techniques used (4)
- T1083 File and Directory Discovery
- T1485 Data Destruction
- T1529 System Shutdown/Reboot
- T1561.001 Disk Content Wipe