AcidRain Malware
Published: 12/23/2025
Written by: Lizzie Danielson
What is AcidRain malware?
AcidRain is a destructive data-wiping malware designed to target modems, routers, and satellite communication devices. Its primary function is to overwrite critical data, rendering systems inoperable. First identified in 2022, AcidRain is believed to have originated as part of a sophisticated cyberattack against Viasat, disrupting critical communication systems in Ukraine. With its focus on low-level firmware, AcidRain has demonstrated its capability to bypass traditional security measures, earning it a high threat level classification.
When was AcidRain first discovered?
AcidRain was first uncovered in early 2022 during an investigation into a widespread network outage affecting Viasat satellite modems in Ukraine. Researchers identified the malware as a custom-developed data wiper capable of indiscriminately erasing device configurations.
Who created AcidRain?
The exact creators of AcidRain remain unknown. However, its technical sophistication and coordinated deployment suggest it may be the product of an advanced persistent threat (APT) group. Some reports link its deployment to state-sponsored actors, adding geopolitical implications.
What does AcidRain target?
AcidRain specifically targets firmware in satellite modems and network devices, disrupting communications infrastructure in high-stakes environments. The attack on Viasat highlighted its ability to cripple systems in critical sectors, including military, telecommunications, and government operations.
AcidRain distribution method
AcidRain is believed to propagate through supply chain attacks, exploiting trusted firmware update mechanisms to initiate infections. By targeting the software supply chain, it evades detection and gains privileged access to critical system components.
Tactics, Techniques & Procedures (TTPs)
AcidRain's common techniques align with MITRE ATT&CK’s framework for destructive wipers, including Data Destruction (T1485), Abuse Elevation Control Mechanism (T1548), and Exploit Public-Facing Applications (T1190).
Indicators of Compromise (IoCs)
IP addresses associated with C2 servers
Hashes of the malware payload
Sudden firmware corruption and communication failures across network devices
Malware Guide
Our malware guide shows you how to shut down those infiltration paths before they ever become a crisis.
How to know if you’re infected with AcidRain?
Symptoms of AcidRain infections include a sudden inability of devices to communicate, loss of stored configurations or firmware data, and widespread device outages across networks.
AcidRain removal instructions
While manual removal of AcidRain is highly technical, affected organizations are advised to isolate infected devices, re-flash firmware with vetted versions, and rebuild configurations. Using endpoint detection and response (EDR) tools like Huntress can aid in identifying and mitigating the impact.
Is AcidRain still active?
Although AcidRain's initial attack was identified in 2022, its threat persists due to the potential for variants or adaptations for new targets. Continuous monitoring of vulnerable infrastructure remains essential.
Mitigation & prevention strategies
Organizations can combat AcidRain by implementing firmware integrity checks, maintaining strict patching protocols, and using multi-factor authentication for access control. Increasing awareness through security awareness training (SAT) and leveraging services like Huntress’ 24/7 monitoring provides an additional layer of defense.
Related educational articles & videos
FAQs
AcidRain is a data-wiping malware that overwrites critical firmware data in modems and routers, rendering them inoperable. It typically propagates via compromised firmware update mechanisms, exploiting systemic weaknesses to achieve its destructive ends.
AcidRain spreads by infiltrating supply chains, particularly firmware update infrastructures. By embedding its wiper functionality into updates, it gains access to connected devices and compromises them at a foundational level.
Yes, AcidRain remains a potential threat due to its destructive capability and possibility of variants targeting new devices and industries. Vigilance and robust cybersecurity protocols are critical to defense strategies.
Organizations can protect themselves by implementing patch management, enforcing endpoint protection measures, and monitoring for IoCs. Using Huntress’ EDR solutions ensures robust detection and mitigation against evolving threats like AcidRain.
Protect What Matters
