AcidPour | New Embedded Wiper Variant of AcidRain Appears in Ukraine

Executive Summary

• SentinelLabs has discovered a novel malware variant of AcidRain, a wiper that rendered Eutelsat KA-SAT modems inoperative in Ukraine and caused additional disruptions throughout Europe at the onset of the Russian invasion.


• The new malware, which we call AcidPour, expands upon AcidRain’s capabilities and destructive potential to now include Linux Unsorted Block Image (UBI) and Device Mapper (DM) logic, better targeting RAID arrays and large storage devices.


• Our analysis confirms the connection between AcidRain and AcidPour, effectively connecting …

acidpour acidrain call capabilities disruptions embedded europe executive invasion ka-sat malware malware analysis novel russian sat sentinellabs ukraine wiper