MITRE ATT&CKsoftware (malware)
S0565 Raindrop
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.3
- Created
- 2021-01-19
Description
Raindrop is a loader used by APT29 that was discovered on some victim machines during investigations related to the SolarWinds Compromise. It was discovered in January 2021 and was likely used since at least May 2020.
Related
Uses · MITRE ATT&CK (7)
- T1027.013 Encrypted/Encoded File sub-technique
- T1497.003 Time Based Checks sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1027.002 Software Packing sub-technique
- T1027.003 Steganography sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1036 Masquerading technique
References
- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ Microsoft Deep Dive Solorigate January 2021
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware Symantec RAINDROP January 2021