S0565 Raindrop

malwareEnterprise

platformsWindows

also known asRaindrop

Raindrop is a loader used by APT29 that was discovered on some victim machines during investigations related to the SolarWinds Compromise. It was discovered in January 2021 and was likely used since at least May 2020.

techniques used (7)

ATT&CK techniques this enables or maps to.

T1027.002Software Packing
T1027.003Steganography
T1027.013Encrypted/Encoded File
T1036Masquerading
T1036.005Match Legitimate Resource Name or Location
T1140Deobfuscate/Decode Files or Information
T1497.003Time Based Checks

used by groups (1)

Threat groups associated with this.

G0016APT29

used by campaigns (1)

Campaigns that use this.

C0024SolarWinds Compromise

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan