New form of data wiper malware linked to attack on Viasat

A freshly uncovered sort of data wiper malware has been linked to an attack that caused common outages on the Viasat satellite internet assistance very last month.

The Viasat KA-SAT network was partially disrupted on Feb. 24, times right after Russia invaded Ukraine. The attack influenced several thousand shoppers in Ukraine and tens of countless numbers of prospects throughout Europe. The assault also prompted an outage of 5,800 wind turbines in Germany since of their reliance on distant monitoring working with Viasat.

Russian hackers have been normally suspected of staying powering the attack, but a lot more particulars have arrive to mild. Security researchers at SentinelOne Inc. today comprehensive new malware they have dubbed “AcidRain,” describing it as a modem wiper that rained down on Europe. AcidRaid is so-termed executable and linkable format malware built to wipe modems and routers.

AcidRain has developmental similarities to a VPNFilter phase 3 destructive plugin. VPNFilter was a type of malware made use of in assaults in 2018 and has been connected by the U.S. Federal Bureau of Investigation and the Section of Justice to the Russian government.

Formally Viasat denies that malware is concerned. In a blog site article yesterday, the organization reported it had discovered “no proof of any compromise or tampering with Viasat modem software or firmware photographs and no evidence of any supply-chain interference” in the attack. It additional claimed that the disruption was brought on by an attack applying inside community access “to execute genuine, focused management instructions on a massive amount of household modems at the same time.”

Viasat promises that the attacker’s damaging command overwrote knowledge in flash memory in the modems, rendering the modems unable to accessibility the community but not forever unusable.

The SentinelOne scientists disagree and say the menace actor utilized the KA-SAT management system in a provide-chain assault to press a wiper designed for modems and routers. The AcidRain wiper, in this case, overwrites essential facts in the modem’s flash memory, rendering it inoperable and in have to have of reflashing or changing.

“Despite Viasat’s statement boasting that there was no provide-chain attack or use of malicious code on the afflicted routers, we posit the a lot more plausible speculation that the attackers deployed AcidRain (and maybe other binaries and scripts) to these products in get to conduct their operation,” the researchers concluded.

Chris Hallenbeck, chief information and facts protection officer for the Americas at cybersecurity and units management enterprise Tanium Inc., informed SiliconANGLE that the hazard is that an assault these as this can unfold further than its initial concentrate on.

“Avoiding the fallout of an errant cyberattack that adversely influences other nations is an crucial thought for the Kremlin,” Hallenbeck reported. “The Russian military services routine is not likely to possibility an overt confrontation with NATO and an uncontained cyberattack that unintentionally impacts a member has the possible to transform the entire dynamic of the war in an instant.”

The use of harmful malware can verify complicated to contain and go much further than its meant intent, Hallenbeck added. “The now notorious Stuxnet assault, for case in point, was identified due to the fact the malware exceeded its intended targets, but it was intended well adequate to avoid its disruptive abilities from running rampant.”

But he mentioned that as the conflict with Ukraine evolves, the threat/reward calculation by Russia could change toward a lot less concern for probable penalties. “Fortunately, we really do not feel to be there however, but there ought to be a eager perception of awareness that Russia has a experienced and able pc network operations software that can make this a credible risk,” he claimed.

Image: Viasat