S0560 TEARDROP

malwareEnterprise

platformsWindows

also known asTEARDROP

TEARDROP is a memory-only dropper that was discovered on some victim machines during investigations related to the SolarWinds Compromise. It was likely used by APT29 since at least May 2020.

techniques used (6)

ATT&CK techniques this enables or maps to.

T1012Query Registry
T1027Obfuscated Files or Information
T1036.005Match Legitimate Resource Name or Location
T1112Modify Registry
T1140Deobfuscate/Decode Files or Information
T1543.003Windows Service

used by groups (1)

Threat groups associated with this.

G0016APT29

used by campaigns (1)

Campaigns that use this.

C0024SolarWinds Compromise

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan