MITRE ATT&CKsoftware (malware)

S0560 TEARDROP

Published 2021-01-06 Modified 2025-04-16 Official page ↗

Domain: enterprise
Platforms: Windows
Version: 1.2
Created: 2021-01-06

Description

TEARDROP is a memory-only dropper that was discovered on some victim machines during investigations related to the SolarWinds Compromise. It was likely used by APT29 since at least May 2020.

Uses · MITRE ATT&CK (6)

T1036.005 Match Legitimate Resource Name or Location sub-technique
T1543.003 Windows Service sub-technique
T1140 Deobfuscate/Decode Files or Information technique
T1012 Query Registry technique
T1027 Obfuscated Files or Information technique
T1112 Modify Registry technique

Referenced by MITRE ATT&CK · uses (2)

C0024 SolarWinds Compromise campaign
G0016 APT29 group

References

https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html FireEye SUNBURST Backdoor December 2020
https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ Microsoft Deep Dive Solorigate January 2021

S0560 TEARDROP

Description

Related

Uses · MITRE ATT&CK (6)

Referenced by MITRE ATT&CK · uses (2)

References