Ankura CTIX FLASH Update - March 22, 2024

Ransomware/Malware Activity

"AcidPour" Data-Wiping Malware Developed to Target Linux x86 Devices

Cybersecurity researchers at SentinelLabs have analyzed a novel data-wiping malware uploaded to the internet from a location in the Ukraine. Dubbed "AcidPour", the malware shares similarities with "AcidRain", the data-wiping malware used in 2022 to target satellite broadband services in Ukraine. Both AcidPour and AcidRain use the same IOCTL (input/output control) wiping mechanism, the same logic for recursive directory wiping, and the same reboot mechanism. However, "AcidPour" appears to be designed to target Linux x86 systems specifically as opposed to devices compiled for a MIPS architecture. The AcidPour code references device paths "/dev/ubiXX" and "/dev/dm-XX". The "/dev/ubiXX" path is common in embedded systems dependent on flash memory such as IoT (Internet-of-Things), networking, and ICS (Industrial Control System) devices. The "/dev/dm-XX" path is