TEARDROP

Description

TEARDROP is a dropper associated with the APT29 group that delivers additional malware payloads through obfuscated code and registry manipulation. Its memory resident design avoided disk artifacts, and researchers discovered it as part of the SolarWinds related intrusion toolkit, where it staged payloads for the espionage operation. Detections under this name indicate nation grade tooling and warrant immediate escalation.

Stats

First seen

February 2022

Last seen

October 2026

Also known as

MITRE ATT&CK techniques

6 techniques across 4 tactics.

Associated groups

• G0016APT29

Associated campaigns

• C0024SolarWinds Compromise

Alert name variants

Related families

References

• malpedia.caad.fkie.fraunhofer.de →
• attack.mitre.org →