By 
Satellite operator Viasat has confirmed that the cyberattack that temporarily knocked KA-SAT modems offline on February 24, 2022, the same day when Russia invaded Ukraine, has been the consequence of a wiper malware.
The U.S. telecom company disclosed that it was the target of a multifaceted and deliberate" cyberattack against its KA-SAT network, linking it to a "ground-based network intrusion by an attacker exploiting a misconfiguration in a VPN appliance to gain remote access to the trusted management segment of the KA-SAT network."
After getting access, the adversary issued "destructive commands" on tens of thousands of modems belonging to the satellite broadband service that "overwrote key data in flash memory on the modems, rendering the modems unable to access the network, but not permanently unusable."
According to the latest research from SentinelOne, a new piece of malware (named "ukrop") was uncovered on March 15 which is a supply chain compromise of the KA-SAT management mechanism to deliver the wiper, dubbed AcidRain, to the modems and routers and achieve scalable disruption.
Security researchers Juan Andres Guerrero-Saade and Max van Amerongen stated that AcidRain is fashioned as a 32-bit MIPS ELF executable that performs an in-depth wipe of the filesystem and various known storage device files. If the code is running as root, AcidRain performs an initial recursive overwrite and delete of non-standard files in the filesystem.
Once the wiping process is complete, the device is rebooted to render it inoperable. AcidRain is the seventh wiper strain to be uncovered this year in connection with the Russo-Ukrainian war after WhisperGate, WhisperKill, HermeticWiper, IsaacWiper, CaddyWiper, and DoubleZero.
On further analysis of the wiper sample, it was found that the code overlap with a third stage plugin ("dstr") used in attacks involving a malware family called VPNFilter, which has been attributed to the Russian Sandworm (aka Voodoo Bear) group.
In late February 2022, the U.K. National Cyber Security Centre (NCSC), the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI) revealed a successor to VPNFilter, calling the replacement framework Cyclops Blink.
However, it is still unclear how the threat actors gained access to the VPN. Viasat confirmed that data destroying malware was indeed deployed on modems using "legitimate management" commands but more details are not available as the investigation process is ongoing.
