Log in Request a demo

Malware profile

AcidRain

AcidRain is a wiper built as an ELF program for modems and routers that use MIPS processors.

In short

AcidRain is a wiper built as an ELF program for modems and routers that use MIPS processors. MITRE ATT&CK says it is associated with the KA-SAT satellite communication outage at the start of the 2022 full-scale invasion of Ukraine. It wipes the file system and storage devices and then reboots the device.

Last updated 9 October 2026

Profile MapMalware
  1. Names1names in public reportsAcidRain
  2. Techniques4ATT&CK techniques listedDiscovery · Impact
  3. Linked Groups1groups that use itSandworm

In one minute

What it is
A wiper for modems and routers with MIPS processors, built as an ELF program for Linux-based network devices.
What it does
Wipes the file system and attached storage devices by overwriting them or sending erase commands, then reboots the device.
Who uses it
Attributed by the UK NCSC (10 May 2022) to Russia, for the KA-SAT attack in which CERT-EU says AcidRain was used. MITRE lists Sandworm Team as linked to it; the sources MITRE cites for that were not all open to us.
How it gets in
No source read states how it got onto the devices.
What to do first
Keep tested backups and recovery plans for network devices that cannot be rebuilt quickly, as NCSC and MITRE advise for destructive attacks.

What it does

MITRE ATT&CK describes AcidRain as an ELF binary for modems and routers with MIPS processors. It lists two platforms, network devices and Linux.

CERT-EU describes a cyberattack on Viasat's KA-SAT satellite network that used a wiper called AcidRain. The UK NCSC assessed on 10 May 2022 that Russia was almost certainly responsible for that attack. The NCSC statement does not name the malware.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
AcidRainMITRE ATT&CK software S1125; CERT-EU report "Russia's war on Ukraine: one year of cyber operations"; ENISA Threat Landscape 2022[1, 7, 8]

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Discovery

  • File and Directory Discovery T1083

    It looks for files and directories on Linux that are linked to storage devices.[1]

Impact

  • Data Destruction T1485

    It wipes the file system and attached storage devices, either by overwriting data or by sending erase commands.[1]

  • System Shutdown/Reboot T1529

    It reboots the device after the wiping is done.[1]

  • Disk Wipe: Disk Content Wipe T1561.001

    It goes through device file identifiers, opens each device file and then overwrites it or sends erase commands.[1]

How it spreads

No government source or MITRE page read for this page says how AcidRain reached the devices it wiped. MITRE describes what the program does once it runs, and the government statements read describe the effects of the KA-SAT attack, not the delivery method.

Timeline

  1. 24 February 2022

    KA-SAT cyber attack

    The UK says a cyber-attack against Viasat began about one hour before Russia launched its major invasion of Ukraine, and that wind farms in central Europe were also affected.[4]

  2. 10 May 2022

    UK NCSC assessment

    The NCSC said it assessed that Russia was almost certainly responsible for the attack on Viasat.[3]

  3. November 2022

    ENISA Threat Landscape

    ENISA reported satellite communications were targeted in an attack in which the AcidRain wiper was used, and that the EU, US and UK had formally pointed at Russia for it.[7]

  4. 24 February 2022 to 24 February 2023

    CERT-EU one-year report

    CERT-EU described a cyberattack on Viasat's KA-SAT network with a wiper dubbed AcidRain.[6]

Detection and defense

  1. Keep backups off the system

    MITRE lists data backup (M1053) as its mitigation for data destruction: regular backups kept off the system and protected from the methods attackers use to destroy them.[8, 9]

    Counters: T1485 T1561.001

  2. Prepare for a highly disruptive attack

    The UK NCSC collection on disruptive cyber attacks covers preparing plans, people and technical capabilities in advance so an organization can operate through disruption and recover. Linking it to wipers is our reading.[10]

    Counters: T1485 T1561.001

  3. Reduce the risk early

    The same NCSC collection offers a framework to prioritize cyber security fundamentals and act early to reduce the likelihood and impact of a highly disruptive attack.[10]

    Counters: T1485

  4. Plan for reboots you cannot block

    MITRE says system shutdown or reboot cannot be easily mitigated with preventive controls because it abuses system features, so recovery planning matters.[11]

    Counters: T1529

Questions

What is AcidRain?

MITRE ATT&CK describes it as an ELF binary that targets modems and routers using MIPS architecture. It wipes the target file system and storage devices and then reboots the device.

Was AcidRain used in the KA-SAT attack?

CERT-EU says a cyberattack on Viasat's KA-SAT satellite network used a wiper dubbed AcidRain. ENISA says the same. MITRE says AcidRain is associated with the KA-SAT outage.

Who is linked to AcidRain?

On 10 May 2022 the UK NCSC assessed that Russia was almost certainly responsible for the attack on Viasat. That statement does not name AcidRain. ENISA says the EU, US and UK formally pointed at Russia for it. MITRE lists Sandworm Team and says Ukrainian government sources linked AcidRain to it.

How can organizations prepare for a wiper like this?

MITRE advises regular backups stored off the system. The UK NCSC has guidance on preparing for and recovering from highly disruptive attacks. We found no government advisory with detection signatures for AcidRain.

In our research

  1. Sandworm (APT44): Russia’s Most Destructive Cyber Weapon November 2025
  2. Geopolitical Countdown: The Evolution of Cyberspace from Espionage to Destruction and New Strategies for Corporate Resilience November 2025
  3. Sandworm Threat group
  4. Wiper malware Glossary term

Sources

  1. AcidRain, Software S1125 MITRE ATT&CKSupports: Description, platforms, techniques, link to the KA-SAT outage and to Sandworm Team.
  2. Sandworm Team, Group G0034 MITRE ATT&CKSupports: MITRE says Sandworm Team is linked to AcidRain deployment during the KA-SAT incident in 2022.
  3. Russia behind cyber attack with Europe-wide impact an hour before Ukraine invasion UK NCSCSupports: NCSC assessment that Russia was almost certainly responsible; published 10 May 2022.
  4. Russia behind cyber-attack with Europe-wide impact an hour before Ukraine invasion UK Foreign, Commonwealth and Development OfficeSupports: Timing of the attack on 24 February and the wider effects.
  5. NCSC Annual Review 2023, Russia case study UK NCSCSupports: NCSC description of the Viasat attack and its spill-over into Europe.
  6. Russia's war on Ukraine: one year of cyber operations CERT-EUSupports: A cyberattack on KA-SAT with a wiper dubbed AcidRain.
  7. ENISA Threat Landscape 2022 ENISASupports: AcidRain used in the targeting of satellite communications; EU, US and UK pointed at Russia.
  8. Data Destruction, Technique T1485 MITRE ATT&CKSupports: Mitigation M1053 Data Backup.
  9. Disk Content Wipe, Technique T1561.001 MITRE ATT&CKSupports: Mitigation M1053 Data Backup.
  10. Disruptive cyber attacks: reducing their impact, reducing the risk UK NCSCSupports: Guidance on preparing for and reducing the risk of highly disruptive attacks.
  11. System Shutdown/Reboot, Technique T1529 MITRE ATT&CKSupports: MITRE says this technique cannot be easily mitigated with preventive controls.

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Wiper malware

Wiper malware is malicious software that destroys data or makes systems unusable by overwriting or deleting files or disk contents.

Read more

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more