“AcidPour” Data-Wiping Malware Developed to Target Linux x86 Devices

Cybersecurity researchers at SentinelLabs have analyzed a novel data-wiping malware uploaded to the internet from a location in the Ukraine. Dubbed “AcidPour”, the malware shares similarities with “AcidRain”, the data-wiping malware used in 2022 to target satellite broadband services in Ukraine. Both AcidPour and AcidRain use the same IOCTL (input/output control) wiping mechanism, the same logic for recursive directory wiping, and the same reboot mechanism. However, “AcidPour” appears to be designed to target Linux x86 systems specifically as opposed to devices compiled for a MIPS architecture. The AcidPour code references device paths “/dev/ubiXX” and “/dev/dm-XX”. The “/dev/ubiXX” path is common in embedded systems dependent on flash memory such as IoT (Internet-of-Things), networking, and ICS (Industrial Control System) devices. The “/dev/dm-XX” path is associated with mapped devices under Logical Volume Management (LVM), putting devices like Storage Area Network (SAN) and Network Attached Storage (NAS) systems within AcidPour’s target scope. These incorporations to the malware suggest that AcidPour targets a broader range of systems than its AcidRain predecessor. A sample of the AcidPour binary analyzed by researchers has been made available on VirusTotal. As of the time of this writing, it is unclear whether AcidPour has been deployed against any known victims. CTIX analysts will continue to report on novel strains of malware and associated campaigns.