TEARDROP

Executive Summary

TEARDROP is a stealthy, memory‑only dropper linked to APT29’s SolarWinds and Solorigate campaigns. By injecting code directly into Windows process memory it bypasses file‑based detections while enabling the download of additional backdoors such as SUNBURST. Security teams should focus on in‑memory detection, process monitoring, and blocking known C2 domains.

TEARDROP is a sophisticated memory‑only dropper that was first identified while investigating the SolarWinds compromise. It never writes executable material to disk; instead it loads malicious code directly into a target process’s address space and executes it in memory, thereby avoiding traditional file‑based detection and maintaining persistence covertly. The malware typically infects Windows hosts through the compromised SolarWinds Orion software or via other supply‑chain channels. Once a victim machine is compromised, TEARDROP injects itself into privileged processes such as rundll32.exe, powershell.exe, or svchost.exe to gain an elevated foothold. By executing in memory it can sidestep antivirus signatures and file‐based monitoring while still enabling the attacker to download additional payloads (e.g., the SUNBURST backdoor) from command‑and‑control infrastructure. Operationally, TEARDROP demonstrates advanced anti‑analysis techniques: it uses reflective DLL injection, process hollowing, and encoded or obfuscated shellcode. The dropper typically employs a two‑stage design where an initial loader stage is delivered via the compromised supply chain, followed by a secondary payload stage that establishes command‑and‑control channels for persistence, data exfiltration, and lateral movement. Its stealthiness has made it particularly effective as a reconnaissance and privilege escalation component within APT29 (Cozy Bear) operations. Impact-wise, the memory‑resident nature of TEARDROP allows attackers to maintain long‑lasting footholds without triggering typical file‑based alerts. It complicates incident response because forensic investigators must analyze process memory dumps; furthermore, legitimate processes that host reflective injection can appear legitimate until deeper analysis is performed.

Key Capabilities

• In-memory loader (no disk persistence)
• Reflective DLL injection
• Process hollowing
• Command‑and‑control channel establishment
• Obfuscated/encoded shellcode
• Privilege escalation via elevated target processes

ATT&CK Techniques

Recommended Actions

• Deploy an Endpoint Detection & Response solution capable of monitoring memory injections and anomalous process creation.
• Implement heuristic rules to detect reflective DLL loads and unexpected process hollowing.
• Block known APT29 C2 communication domains and IPs using threat intelligence feeds.
• Enforce least‑privilege accounts and disable execution policy for unknown PowerShell scripts.
• Regularly review system logs for repeated failed authentication or unexpected service restarts.
• Conduct memory forensic analysis on critical hosts after a suspected compromise.

Suggested Tags