Enlarge / A Viasat internet satellite dish in the yard of a house in Madison, Virginia. (credit: Getty Images)
Viasat—the high-speed-satellite-broadband provider whose modems were knocked out in Ukraine and other parts of Europe earlier this month—has confirmed a theory by third-party researchers that new wiper malware with possible ties to the Russian government was responsible for the attack.
In a report published Thursday, researchers at SentinelOne said they uncovered the new modem wiper and named it AcidRain. The researchers said AcidRain shared multiple technical similarities to parts of VPNFilter, a piece of malware that infected more than 500,000 home and small-office modems in the US. Multiple US government agencies—first the FBI and later organizations including the National Security Agency—have all attributed the modem malware to Russian state threat actors.
Enter ukrop
SentinelOne researchers Juan Andres Guerrero-Saade and Max van Amerongen posited that AcidRain was used in a cyberattack that sabotaged thousands of modems used by Viasat customers. Among the clues they found was the name “ukrop” for one of AcidRain’s source binaries.
