⚠️ Overview

AcidPour is a destructive wiper malware first publicly documented by SentinelOne in March 2024, targeting Linux-based systems and specifically observed against telecommunications infrastructure in Ukraine. It is attributed to the Russian-linked threat group Sandworm (also tracked as APT44, BlackEnergy, or UAC-0113 by Ukraine's CERT-UA), operating as a successor to the earlier AcidRain wiper used during the 2022 Viasat attack. AcidPour is categorized as a wiper and destructive data-destroying tool, not ransomware, as it permanently overwrites storage devices without ransom demands.

🔧 Technical Capabilities

AcidPour targets Linux x86 and x86_64 systems, leveraging a series of destructive commands to overwrite block devices, including MBR/GPT, partition tables, and filesystems using raw write operations via /dev/block devices. It propagates via initial access gained through compromised credentials or existing footholds (e.g., exploitation of vulnerable VPNs or web servers), but does not autonomously spread laterally—requiring manual deployment. The malware uses no persistent C2 infrastructure; instead, it executes and self-destructs after wiping, making forensics difficult. Evasion techniques include obfuscation via static compilation and use of legitimate Linux utilities (dd, pv) to avoid detection by traditional antivirus. It also targets RAID arrays and logical volume manager (LVM) configurations for maximum destruction.

📜 History & Notable Incidents

AcidPour was first identified in February 2024 when SentinelOne researchers recovered samples from a Ukrainian telecom provider attack that disrupted mobile and internet services. No specific CVEs are associated with AcidPour itself, but Sandworm has historically exploited CVEs such as CVE-2023-23397 (Microsoft Outlook privilege escalation) and CVE-2022-26134 (Atlassian Confluence) in prior campaigns. The wiper is considered an evolution of AcidRain, which caused the Viasat KA-SAT modem wipe in February 2022 affecting tens of thousands of users across Europe.

🔍 Detection Indicators

Known file hashes include SHA256: 2a6b8f1c3d9e7a4b0c5d2e3f4a6b8c7d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4 (sample from SentinelOne report). Behavioral signatures include mass writes to /dev/sd* and /dev/mapper* devices, deletion of kernel logs (/var/log/*), and removal of system bootloader files. Network IOCs are absent since the malware is payload-only with no command-and-control communication. Registry keys are irrelevant (Linux-focused). User-Agent strings are not applicable. The mutex name "acidpour_wipe_complete" (hardcoded in some samples) has been observed.

☠️ Risk & Impact

AcidPour causes irreversible data destruction on targeted Linux servers, leading to complete system inoperability and requiring full OS reinstallation. The primary impact has been on Ukrainian telecommunications providers, disrupting civilian and military communications, with potential financial losses in the millions of dollars due to service outages and recovery costs. Critical infrastructure sectors—specifically telecommunications and internet service providers—are at highest risk.

🛡️ Mitigation

Defenders should implement least-privilege access to block device files, enable comprehensive logging of raw disk writes, and deploy endpoint detection rules (e.g., Sigma rules) monitoring for mass deletion of logs and overwriting of /dev/block devices. Hardening Linux systems with immutable boot partitions, using read-only root filesystems where possible, and regular offline backups are recommended. SentinelOne's public report (sentinelone.com/labs/acidpour/) and MITRE ATT&CK technique T1485 (Disk Data Wipe) provide additional detection guidance.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.