Sandworm-Linked Threat Actors Attack Ukrainian ISPs Using AcidPour Wiper Malware

Cybersecurity media outlets reported that multiple Ukrainian internet service providers (ISPs) were hit by cyberattacks causing connectivity disruptions ^[1]. Reports linked the campaign to threat actors considered a subgroup of Sandworm and highlighted the deployment of AcidPour, an embedded wiper malware ^[2]. As a source-attributed state-sponsored destructive campaign, critical communications operators should strengthen resilience and backups in accordance with CERT-UA guidance ^[2].

Industries mainly affected: Telecom

This is a source-attributed state-sponsored destructive campaign; operators should strengthen critical communications redundancy in accordance with CERT-UA guidance ^[2].