AcidPour
AcidPour is a variant of AcidRain designed to impact a wider range of x86 architecture Linux devices. AcidPour is an x86 ELF binary that expands on the targeted devices and locations in AcidRain by including items such as Unsorted Block Image (UBI), Deice Mapper (DM), and various flash memory references. Based on this expanded targeting, AcidPour can impact a variety of device types including IoT, networking, and ICS embedded device types.[1] AcidPour is a wiping payload associated with the Sandworm Team threat actor, and potentially linked to attacks against Ukrainian internet service providers (ISPs) in 2023.[2]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1485 | Data Destruction |
AcidPour can perform an in-depth wipe of victim filesystems and attached storage devices through either data overwrite or calling various IOCTLS to erase them, similar to AcidRain.[1] |
|
| Enterprise | T1561 | .001 | Disk Wipe: Disk Content Wipe |
AcidPour includes functionality to overwrite victim devices with the content of a buffer to wipe disk content.[1] |
| Enterprise | T1083 | File and Directory Discovery |
AcidPour can identify specific files and directories within the Linux operating system corresponding with storage devices for follow-on wiping activity, similar to AcidRain.[1] |
|
| Enterprise | T1070 | .004 | Indicator Removal: File Deletion |
AcidPour includes a self-delete function where the malware deletes itself from disk after execution and program load into memory.[1] |
| Enterprise | T1120 | Peripheral Device Discovery |
AcidPour includes functionality to identify MMC and SD cards connected to the victim device.[1] |
|
| Enterprise | T1082 | System Information Discovery |
AcidPour can identify various system locations and mapped devices on Linux systems as a precursor to wiping activity.[1] |
|
| Enterprise | T1529 | System Shutdown/Reboot |
AcidPour includes functionality to reboot the victim system following wiping actions, similar to AcidRain.[1] |
|
Groups That Use This Software
| ID | Name | References |
|---|---|---|
| G0034 | Sandworm Team |
AcidPour is associated with Sandworm Team.[1] |