Loading story…
Researchers reported new destructive malware targeting embedded and IoT devices, including a newly identified Kaden botnet and a new LOLFME variant tied to the KekSec ecosystem, while AcidPour surfaced as a new embedded wiper variant of AcidRain in Ukraine. The findings point to continued evolution of Linux-based malware capable of disrupting routers, modems, and other edge devices that are often used in critical infrastructure environments.
Forescout said Kaden blends code from rebirth, Gafgyt, Mirai variants, and Silex, and contains a wiping function that is present but not yet connected to an active C2 command. The newer LOLFME sample appears more mature, with logic to wipe a device if it loses contact with its command server and a bricklol capability designed to destroy logs, storage, and networking before rebooting the host. Researchers used YARA hunting based on earlier IoT wipers including AcidRain, AcidPour, BrickerBot, HEH, VPNFilter, Silex, and HandyMannyPot, and said there is not yet confirmed evidence that the Kaden or LOLFME wipers have been deployed at scale in the wild.
See affected versions and whether adversaries are exploiting it.
11 events from the most recent confirmed update back to the earliest known activity.
A follow-up search and LiveHunt identified 22 total Kaden botnet samples through the end of June 2024, with only the last five containing the wiping function matched by the YARA rule.
Forescout says a LiveHunt from May through the end of June 2024 found four recent LOLFME-related samples that contacted 192.3.117[.]132.
Forescout reports that most Kaden samples were newly submitted between February and May 2024, which it assesses as evidence of ongoing botnet development.
The RetroHunt returned eight matches, including three samples resembling a KekSec LOLFME variant and five samples containing the string "KADENBOTNET."
Forescout researchers built a YARA rule from 25 known IoT wiper samples and deployed it in VirusTotal RetroHunt to search files submitted between February and May 2024 for wiping behavior.
Forescout says AcidPour, a newer variant of AcidRain, was used in attacks against Ukrainian telecommunication networks in 2024.
Forescout states that AcidRain was used by a Russian APT to brick satellite modems in Europe at the start of Russia's 2022 invasion of Ukraine.
Forescout reports that one Kaden C2 IP, 185.244.25[.]166, previously resolved in 2019 to alex-botnet[.]xyz and related subdomains, indicating earlier botnet infrastructure overlap.
The Forescout analysis states that BrickerBot has existed since at least 2017 and is described as the first known IoT wiper.
Forescout says the KekSec group was created in 2016 and later became known for botnet development including Mirai and Gafgyt variants as well as Necro, LOLFME, and EnemyBot.
Forescout links strings in Kaden samples to a YouTube profile, @Kaden1227, that uploaded botnet-related videos between 2018 and 2020 advertising compromised-device access and a DDoS stresser service.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 42 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed multiple destructive malware families used against Ukrainian targets, linking **AcidRain**, **AcidPour**, and **CaddyWiper** to attacks designed to disable systems and erase data during Russia’s war against Ukraine. Trellix reported that AcidRain was used to disrupt Viasat **KA-SAT** satellite modems, while the newer Linux wiper **AcidPour** adds features including self-overwrite, a configurable execution delay, and recursive wiping of `/boot`. The firm assessed with medium confidence that AcidPour was derived from or closely modeled on AcidRain, and said the activity broadly aligns with a pro-Russian actor, though it did not attribute the attacks to a specific group. On the Windows side, Morphisec said **CaddyWiper** struck several dozen systems in a limited number of Ukrainian organizations and was likely deployed through **Group Policy Object**, indicating prior compromise of an **Active Directory** server. The malware was built to destroy user files and attached drives, and when executed with administrative privileges it also corrupts physical drive partition information, leaving the operating system unusable. Researchers noted that CaddyWiper selectively avoids damaging non-domain-controller systems and dynamically resolves Windows APIs through the **PEB** to hinder detection, placing it among a broader run of wipers including **WhisperGate**, **HermeticWiper**, and **IsaacWiper**.
Aug 14, 2026
Researchers reported that multiple **Gafgyt/Bashlite** variants targeting IoT devices are reusing leaked **Mirai** source code while continuing to evolve their infection and attack capabilities. Analyses found shared modules for **HTTP, UDP, and TCP flooding**, a telnet brute-force scanner, and other botnet functions, alongside exploitation of known router flaws including `CVE-2017-17215`, `CVE-2014-8361`, and `CVE-2018-10561`. Separate reporting also described campaigns abusing exposed **SSH**, **Telnet**, and **WeMo UPnP** services to drop first-stage shell scripts and architecture-specific ELF payloads that conscript devices into distributed denial-of-service operations. Recent samples show operators tailoring payloads for stealth and persistence after compromise. One analyzed ELF binary, packed with **UPX** and masquerading as `/usr/bin/apt`, was observed beaconing to `45.61.186.4:13561`, killing rival malware, flushing `iptables`, stopping local firewall services, clearing shell history, and altering DNS settings before accepting commands for **TCP, UDP, GRE, ICMP, HTTP, and game-server-focused floods**. Other reports noted process renaming, heavy forking, changing filenames and infrastructure, and added backdoor or cryptomining functions, indicating that Gafgyt operators are using modular, frequently modified malware to evade detection and sustain IoT-focused DDoS campaigns.
Aug 15, 2026
Multiple destructive malware campaigns struck Ukraine around the start of Russia’s invasion, with **HermeticWiper**, **IsaacWiper**, **CaddyWiper**, **WhisperGate**, and **DoubleZero** used against government, financial, and other organizations. Researchers reported that HermeticWiper corrupted boot records and partition data by abusing a legitimate EaseUS driver, while CaddyWiper and DoubleZero erased user data, partition information, and critical registry or boot components, often while deliberately sparing domain controllers to preserve attacker access. Several incidents appeared to follow prior compromise of victim networks, including abuse of **Active Directory**, scheduled execution, and in some cases worm-like spread via **HermeticWizard**; HermeticRansom was also deployed as a likely decoy alongside destructive activity. The destructive operations extended beyond enterprise Windows environments. **AcidRain** was used in the attack on Viasat’s **KA-SAT** network, wiping satellite modems in Ukraine and elsewhere in Europe by recursively destroying filesystems and storage devices, while the **Industroyer2** operation targeted a Ukrainian energy provider with malware built to communicate over **IEC-104** and cut power, paired with Windows, Linux, and Solaris wipers including **CaddyWiper**, **ORCSHRED**, **SOLOSHRED**, and **AWFULSHRED**. Across the reporting, defenders were urged to watch for mass file overwrites, shadow copy and event log deletion, MBR or partition changes, suspicious use of administrative tooling and group policy, and to maintain tested, isolated backups to recover from destructive attacks.
Aug 15, 2026