AcidPour

Executive Summary

AcidPour is a destructive Linux wiper linked to the Sandworm Team that targets embedded IoT, networking, and industrial control systems using UBI, DM, and flash memory interfaces. Its primary objective is to erase firmware and configuration data, causing prolonged system downtime for critical infrastructure. The variant extends AcidRain’s reach into devices previously unimpacted, raising serious concerns for a wide range of industry sectors.

AcidPour is a Linux‑based, x86 ELF executable that extends the original AcidRain wiper family to target a broader spectrum of embedded devices running on common processor architectures and firmware stacks. By adding support for identifiers such as Unsorted Block Image (UBI) volumes, Device Mapper (DM) partitions, and generic flash memory interfaces, AcidPour can locate, enumerate, and overwrite critical storage areas across a range of Internet‑of‑Things (IoT), networking equipment, and industrial control system (ICS) devices that were previously out of reach for the original variant. The malware is specifically engineered to perform destructive data wiping during its execution. Once deployed on compromised systems, it systematically deletes or corrupts firmware partitions, erases configuration files, and removes evidence of previous compromise, thereby disabling device functionality and causing prolonged downtime for targeted infrastructures. Reports from SentinelOne (2024) and CERT‑UA (2023) attribute the operation to the Sandworm Team—an advanced persistent threat group associated with state‑level cyber‑espionage—and link it to a series of sabotage attacks against Ukrainian internet service providers in 2023, underscoring its role as a strategic tool for infrastructure disruption. Operationally, AcidPour leverages native Linux utilities and system calls to discover writable partitions exposed via UBI or DM interfaces. It then writes zeroed blocks or overwrites firmware images across multiple storage volumes, effectively rendering the device inoperable without triggering anti‑tamper mechanisms. The malware’s minimal footprint—an 80‑kilobyte ELF binary—allows it to evade casual monitoring while still delivering a devastating payload on affected devices.

Key Capabilities

• Wipes or corrupts firmware partitions using UBI/DM interfaces
• Targets Linux‑based IoT and industrial control devices
• Deletes configuration files to disable device functionality
• Evades detection with a small ELF binary footprint

ATT&CK Techniques

Recommended Actions

• Deploy endpoint monitoring on all Linux‑based embedded devices for anomalous file deletions in /dev, /boot, and /mnt directories
• Block known C2 domains and IPs associated with Sandworm Team activity
• Implement firmware integrity checks that verify UBI and DM partition hashes before booting
• Enforce least privilege to limit file write permissions on critical system partitions
• Educate network engineers to detect unusual traffic patterns indicative of inbound command payloads

Suggested Tags