AcidPour
- ID
- S1167
- Type
- Malware
- Platforms
- Linux
- Source
- attack.mitre.org
- MITRE last modified
- 18 Apr 2025
AcidPour is a variant of AcidRain designed to impact a wider range of x86 architecture Linux devices. AcidPour is an x86 ELF binary that expands on the targeted devices and locations in AcidRain by including items such as Unsorted Block Image (UBI), Deice Mapper (DM), and various flash memory references. Based on this expanded targeting, AcidPour can impact a variety of device types including IoT, networking, and ICS embedded device types.[1] AcidPour is a wiping payload associated with the Sandworm Team threat actor, and potentially linked to attacks against Ukrainian internet service providers (ISPs) in 2023.[2]
Techniques used (7)
- T1070.004 File Deletion
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1120 Peripheral Device Discovery
- T1485 Data Destruction
- T1529 System Shutdown/Reboot
- T1561.001 Disk Content Wipe