On March 31, 2022, SentinelOne researchers published a report that detailed the use of “AcidRain” malware in the late February 2022 cyberattack of Viasat, a US satellite communications provider. The cyberattack targeted the Viasat KA-SAT satellite broadband service and resulted in wiping SATCOM modems, which affected tens of thousands in Ukraine and across Europe. According to SentinelOne, AcidRain is the “7th wiper malware associated with the Russian invasion of Ukraine” and was first identified on March 15th, 2022. The researchers hypothesized that “the threat actor used the KA-SAT management mechanism in a supply-chain attack to push a wiper designed for modems and routers,” a theory that was supported by Viasat, who in an interview with TechCrunch affirmed the use of a “legitimate management command.” SentinelOne researchers also, with medium confidence, detailed the “developmental similarities” between AcidRain and the “VPNFilter” campaign that was attributed to the Russian government in 2018. The VPNFilter campaign consisted of “an impressive array of functionality in the form of multi-stage plugins” and the researchers noted “an interesting (but inconclusive) code overlap” between a specific plugin of VPNFilter and AcidRain. An in-depth technical analysis of AcidRain and the potential VPNFilter connection, as well as indicators of compromise (IOCs), can be reviewed in SentinelOne’s report linked below.