Rewterz Threat Alert – AcidRain Wiper – Active IOCs – Russian-Ukrainian Cyber Warfare

Severity

Medium

Analysis Summary

Viasat KA-SAT modems were rendered inoperable in February of 2022 due to a cyber attack. Around 5,800 Enercon wind trubines were unable to communicate for controlling and remote monitoring. AcidRain AcidRain is an ELF MIPS malware designed to wipe modems and routers. A previous VPNFilter campaign is also being linked to AcidRain due to the similarities both possess. Viasat confirmed in a statement that the AcidRain Wiper was indeed used in the against their modems.

“On 24 February 2022, a multifaceted and deliberate cyber-attack against Viasat’s KA-SAT network resulted in a partial interruption of KA-SAT’s consumer-oriented satellite broadband service. While most users were unaffected by the incident, the cyber-attack did impact several thousand customers located in Ukraine and tens of thousands of other fixed broadband customers across Europe. “

Impact

• Data Loss
• File Encryption
• Financial Loss

Indicators of Compromise

Filename

• ukrop

MD5

• ecbe1b1e30a1f4bffaf1d374014c877f
• 20ea405d79b4de1b90de54a442952a45

SHA-256

• 9b4dfaca873961174ba935fddaf696145afe7bbf5734509f95feb54f3584fd9a
• 47f521bd6be19f823bfd3a72d851d6f3440a6c4cc3d940190bdc9b6dd53a83d6

SHA-1

• 86906b140b019fdedaaba73948d0c8f96a6b1b42
• 261d012caa96d3e3b059a98388f743fb8d39fbd5

Remediation

• Block all the threat indicators at your respective controls.
• Search for IOCs in your environment.