Thread by @juanandres_gs

We've had 6 wipers in the wake of the Ukraine invasion but the biggest elephant in the room has been the infamous 'satellite modem hack'. Despite statements saying there was no malware involved, we believe it was the work of a 7th wiper– AcidRain

AcidRain is a 32-bit MIPS ELF wiper uploaded to VT from Italy on March 15th with the name 'ukrop'. It's a more generic wiper in that it attempts to bruteforce device file names and wipe any and all, and can be reused for a future op.

Interestingly, there are two wiping mechanisms. The first copies from an array of 4-byte integers starting at 0xffffffff, decrementing at each index.

If you're wondering what that might look like...

https://twitter.com/reversemode/status/1509467387954962432?s=20&t=WMU0isojrHaasS1bd-aXuw

The second is through a combination of IOCTLs, MEMGETINFO, MEMUNLOCK, MEMERASE, MEMWRITEOOB.

As we consider who may have developed AcidRain, it's interesting to note that the same IOCTLs combo was used in a VPNFilter stage 3 plugin, called 'dstr'.

We posit that there are noteworthy developmental traits connecting this VPNFilter plugin and AcidRain but do our best not to overhype that idea. It's a hypothesis in need of stress testing and we invite the research community to take a look and share their findings.

I imagine more details will come from @ViasatInc in the future. Perhaps they'll share the actual findings from their excellent incident responders. I'm afraid their statement was so vague as to become unwittingly inaccurate (a charitable interpretation, perhaps).

Massive recognition to @maxpl0it who nailed the reversing, @TomHegel, @philofishal, and the whole @LabsSentinel team, as well as all of the researchers that silently contributed with no hope of glory.

For more on AcidRain– #HappyHunting and #SlavaUkraini
s1.ai/acidrain

@maxpl0it @TomHegel @philofishal @LabsSentinel @ViasatInc has confirmed the involvement of AcidRain :)

https://twitter.com/zackwhittaker/status/1509601023047970820?s=20&t=WMU0isojrHaasS1bd-aXuw