Viasat KA-SAT Network Sabotage
Operation AcidRain / GRU Unit 74455
EXECUTIVE SUMMARY: On the eve of the kinetic invasion of Ukraine, Russian military intelligence executed a highly coordinated supply-chain attack against the Viasat KA-SAT satellite network. By exploiting a VPN misconfiguration at a ground station in Turin, Italy, threat actors deployed a custom wiper malware to tens of thousands of customer edge devices, resulting in catastrophic communication failures across Ukraine and severe collateral infrastructure damage across Europe.
Executive Brief // BLUF
Russian military intelligence apparatus, specifically Unit 74455, responsible for prior disruptive cyber-physical attacks (NotPetya, Industroyer).
High-speed satellite broadband network providing critical communication links across Europe, heavily relied upon by Ukrainian military forces.
Severing Ukrainian military command and control (C2) capabilities immediately preceding the physical invasion on Feb 24, 2022.
30,000+ modems bricked EU-wide. Severe collateral damage affecting German wind turbine infrastructure (Enercon) and broader European broadband customers.
PRE-INVASION
Initial Infrastructure Breach
TA ACTIVITYThreat actors (attributed to Sandworm) exploit a misconfigured VPN appliance to gain unauthorized access to the trusted management segment of the KA-SAT network at Skylogic's ground station in Turin, Italy.
05:00 UTC
Phase 1: Traffic Anomaly
NET ANOMALYCoinciding with the start of the kinetic invasion of Ukraine, high volumes of malicious traffic originate from modems within Ukraine, causing initial network congestion and DoS conditions.
05:02 UTC
Phase 2: Mass Payload Deployment
CRITICAL EVENT
Attackers move laterally and abuse trusted management commands to deploy the AcidRain wiper malware. The binary recursively wipes the filesystem of tens of thousands of modems simultaneously and forces a reboot.
ANALYSIS
Collateral Damage Assessment
IMPACT ASSESSMENTMassive collateral damage reported across Europe. Most notably, ~5,800 Enercon wind turbines in Germany lose remote monitoring and control capabilities. Modems require physical replacement or manual reflashing by technicians.
VPN Exploitation
Exploited misconfigured VPN appliance to breach Turin ground station.
Network Traversal
Navigated from the VPN entry point into the trusted KA-SAT management segment.
Payload Delivery
Used legitimate management tools to push the AcidRain wiper disguised as a firmware update.
Data Destruction
AcidRain executes, overwrites flash memory, and bricks ~30,000+ modems instantly.
AcidRain Wiper
A Linux MIPS ELF binary designed specifically to render embedded devices (modems, routers) inoperable. It utilizes a brute-force wiping approach, performing an in-depth, recursive wipe of the filesystem.
| TYPE | VALUE |
|---|---|
| SHA-256 | d00083bd1b26f584e85743c5b8e968037004fdbfa14cb351f08f83034293f0b4 |
| FILE_TYPE | ELF 32-bit LSB executable (MIPS) |
| FAMILY | VPNFilter / AcidPour |
| TARGET_ARCH | MIPS (Big-endian / Little-endian) |
Indicators of Compromise
Actionable threat intelligence feed derived from the AcidRain deployment. Use these artifacts to scan infrastructure for dormant wiper components.
| TYPE | INDICATOR | DESCRIPTION | ACTION |
|---|---|---|---|
| SHA-256 | e82d8c39e0bd589f7a93a1cf5536412f11cc5cf065a397c729c1fb297491ffbd | AcidRain primary ELF executable (MIPS) | |
| SHA-256 | 19c36dfc19bdf01a7000e3da9b5f58ed34b281f6233ba38d6fc5dae7bfa5dbfc | AcidRain variant observed in secondary cluster | |
| IPv4 | 185.x.x.x (Redacted) | Compromised Skylogic VPN endpoint utilized for initial access | |
| YARA | APT_Wiper_AcidRain_ELF_Mar22 | Detects specific device enumeration loops (`/dev/mtdblock`) |
GRU Unit 74455
State Actor| ALIASES | Sandworm, Voodoo Bear, UAC-0082 |
| ORIGIN | Russian Federation (GRU) |
Highly sophisticated military cyber unit. Historic operations include NotPetya (2017), Ukrainian power grid blackouts (Industroyer, 2016), and Olympic Destroyer (2018).
-
JAN
WhisperGateWiper masquerading as ransomware (UA Gov).
-
FEB
HermeticWiperDeployed pre-invasion on UA financial sector.
Mitigation and Recovery
The Hardware Problem
Unlike traditional malware that encrypts files for ransom, AcidRain was designed as a pure wiper. It deliberately overwrote the flash memory (`/dev/mtdblock`) of the SurfBeam2 modems.