threatintel
actor tracker
IOC pivot
ioc · sha-256

9b4dfaca873961174ba935fddaf696145afe7bbf5734509f95feb54f3584fd9a

RU · RussiaSandwormconfidence · high

AcidRain - MIPS ELF wiper (filename 'ukrop') that bricked modems on Viasat's KA-SAT network on 24 February 2022, disrupting service across Ukraine and downstream wind-turbine telemetry in Germany. SentinelLabs published the hash and noted code overlap with VPNFilter (attributed to Sandworm).

family
AcidRain
first seen
Feb 23, 2022
publisher
SentinelLabs
source citation