Viasat KA-SAT AcidRain wiper attack

At 04:25 UTC on February 24, 2022, approximately one hour before Russian ground forces crossed into Ukraine, attackers operating from inside the Skylogic management network in Turin pushed the AcidRain wiper to tens of thousands of Viasat KA-SAT SurfBeam2 satellite modems across Europe. Initial access traced to a misconfigured VPN appliance approximately six hours earlier. AcidRain enumerated flash and storage devices on each modem and overwrote them, rendering 40,000 to 45,000 units permanently inoperable. The most consequential downstream effect outside Ukrainian government and military communications was the loss of remote monitoring and control of approximately 5,800 Enercon-operated wind turbines distributed across Germany and other EU states (representing approximately 11 GW of nameplate capacity); turbines continued to generate but operators lost telemetry and remote-shutdown capability for days. SentinelLabs published the AcidRain technical analysis on March 31, 2022, identifying functional overlap with VPNFilter components previously attributed to Sandworm. On May 10, 2022, the European Council, the United Kingdom, and the United States issued coordinated statements publicly attributing the attack to the Russian Federation.

Approximately 40,000 KA-SAT modems destroyed; remote control of 5,800 Enercon wind turbines lost for days; widespread civilian and B2B satellite-broadband outage across Europe; degradation of Ukrainian military communications at H-hour of the Russian invasion; subsequent EU-wide review of satellite-network operator security postures.