TEARDROP

MITRE ATT&CK: S0560 View on attack.mitre.org

Aliases: TEARDROP

First seen
2020-05-01 00:00:00
Malware type
dropper
Family
Malware family
Operating systems
windows
Related IoCs
4 (4 malicious)
Last IoC activity
2026-09-15 21:46:59
Profile updated
2026-07-07 12:58:31

Targeted industries: government-and-public-sector technology-and-telecommunications

Targeted regions: country_code:us country_code:gb

Context

TEARDROP is a memory-only dropper that was discovered on some victim machines during investigations related to the SolarWinds Compromise. It was likely used by APT29 since at least May 2020.

Recent IoC activity

4 malicious indicators in Maltiverse are attributed to TEARDROP (S0560). The 4 most recently updated:

TypeIndicatorUpdatedSources
file sample 3bf939157f659e80bd9f5056aaa12edca9c2577e6cc3bedb85f7b0805259e991 2026-09-15 1
file sample TEARDROP_infected.zip 2026-09-03 1
file sample MOTIF_bd842c41b4c1b3c2deb475d7a3876599_refanged.exe 2026-06-26 1
file sample CPUIDHWMonitor.exe 2026-03-20 2

Detection coverage

  • 2 YARA rules
  • 240 Sigma rules

Malware & tools used

  • Query Registry (attack-pattern)
  • Obfuscated Files or Information (attack-pattern)
  • Modify Registry (attack-pattern)
  • Windows Service (attack-pattern)
  • Match Legitimate Resource Name or Location (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)

Used by threat actors

  • SolarWinds Compromise (campaign)
  • APT29 (threat-actor)

Detection rules

  • SIGNATURE_BASE_APT_Dropper_Raw64_TEARDROP_1 (yara-rule)
  • SIGNATURE_BASE_APT_Dropper_Win64_TEARDROP_1 (yara-rule)

Reports & references

  • medium.com — Identifying Unc2452 Related Techniques 9F7B6C7F3714 (report)
  • Mandiant — Evasive Attacker Leverages Solarwinds Supply Chain Compromises With Sunburst Backdoor (report)
  • Microsoft — Analyzing Solorigate The Compromised Dll File That Started A Sophisticated Cyberattack And How Microsoft Defender Helps Protect (report)
  • github.com — Sunburst Countermeasures (report)
  • Microsoft — Goldmax Goldfinder Sibot Analyzing Nobelium Malware (report)
  • Palo Alto Unit 42 — Solarphoenix (report)
  • CrowdStrike — Report2021Gtr (report)
  • Palo Alto Unit 42 — Solarstorm Supply Chain Attack Timeline (report)
  • blog.bushidotoken.net — Space Invaders Cyber Threats That Are (report)
  • Broadcom/Symantec — Attacks Against Government Sector (report)
  • Microsoft — Using Microsoft 365 Defender To Coordinate Protection Against Solorigate (report)
  • research.checkpoint.com — Sunburst Teardrop And The Netsec New Normal (report)
  • Cisco Talos — Solarwinds Supplychain Coverage (report)
  • accenture.com — Threat Intel Takeaways Solarigate (report)
  • Microsoft — December 21St 2020 Solorigate Resource Center (report)
  • Broadcom/Symantec — Sunburst Supply Chain Attack Solarwinds (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Teardrop (report)
  • CISA — Ar21 039B (report)
  • twitter.com — 1339954817247158272 (report)
  • twitter.com — 1346096298311741440 (report)
  • twitter.com — 1342041055563313152 (report)
  • MITRE ATT&CK — S0560 (report)
  • 0xc0decafe.com — Malware Analyst Guide To Pe Timestamps (report)
  • blog.securehat.co.uk — Extracting The Cobalt Strike Config From A Teardrop Loader (report)
  • sans.org — Contrarian View Solarwinds 119515 (report)

External references