TEARDROP

For the SolarWinds Compromise, APT29 used numerous pieces of malware that were likely developed for or by the group, including SUNBURST, SUNSPOT, Raindrop, and TEARDROP.

We assess that threat actors will almost certainly continue to develop their capability to compromise organizations through supply chains as an alternative to direct action against a target’s network defences.

State-sponsored threat actors have demonstrated their ability to compromise service providers such as MSPs as a method of infiltrating the supply chain of organizations of strategic interest, establishing persistence, and securing access to downstream targets.

"It is distributed through a wide-scale malicious email campaign operated by NOBELIUM"

“On May 25, 2021, the campaign escalated as NOBELIUM leveraged the legitimate mass-mailing service, Constant Contact, to masquerade as a US-based development organization and distribute malicious URLs…”

This week, VA officials told reporters there are currently no signs the hackers took advantage of the backdoor in their network, which was unwittingly installed by roughly 18,000 SolarWinds clients this year.

MITRE ATT&CK® Techniques... System Services: Service Execution [T1569.002]

The content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution.

Catchamas creates three Registry keys to establish persistence by adding a Windows Service; TEARDROP modified the Registry to create a Windows service for itself; NightClub set the ServiceDLL for a service created by the malware.

If further actions were taken, TEARDROP or RAINDROP backdoors would be deployed, which would install a customized Cobalt Strike beacon in the environment.

MITRE ATT&CK Mappings: APT29 Privilege Escalation T1055: Process Injection .002: Portable Executable Injection

Catchamas creates three Registry keys to establish persistence by adding a Windows Service; TEARDROP modified the Registry to create a Windows service for itself; NightClub set the ServiceDLL for a service created by the malware.

If further actions were taken, TEARDROP or RAINDROP backdoors would be deployed, which would install a customized Cobalt Strike beacon in the environment.

The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.

"SHOTPUT is obscured using XOR encoding and appended to a valid GIF file." / "TEARDROP created and read from a file with a fake JPG header" / "Ramsay has base64-encoded its portable executable and hidden itself under a JPG header."

JPIN uses a encrypted and compressed payload that is disguised as a bitmap within the resource section of the installer. Ramsay has base64-encoded its portable executable and hidden itself under a JPG header. TEARDROP created and read from a file with a fake JPG header.

During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.

MITRE ATT&CK Mappings: APT29 Privilege Escalation T1055: Process Injection .002: Portable Executable Injection

The content repeatedly describes malware and threat actors decoding, decrypting, or deobfuscating payloads, strings, configuration data, commands, and C2 traffic prior to execution or use, e.g., 'APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload' and 'Action RAT can use Base64 to decode actor-controlled C2 server communications.'

“...lateral movement using Windows Management Instrumentation (WMI) to run the attacker’s payload using the Rundll32.exe process.”

Leveraging memory-only droppers to deploy Cobalt Strike BEACON and potentially other backdoors.

The content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution.

The malware deployed into the Orion Platform, known as Teardrop, was highly sophisticated, according to experts, and in addition to harvesting users’ credentials and monitoring their keystrokes...

The malware deployed into the Orion Platform, known as Teardrop, was highly sophisticated, according to experts, and in addition to harvesting users’ credentials and monitoring their keystrokes...

The content repeatedly describes malware and threat actors querying, enumerating, searching, reading, or checking Windows Registry keys and values, e.g., "ADVSTORESHELL can enumerate registry keys," "APT41 queried registry values to determine items such as configured RDP ports and network configurations," and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."

TEARDROP or RAINDROP backdoors would be deployed, which would install a customized Cobalt Strike beacon in the environment, enumerating the domain and allowing for the collection and exfiltration of information of value.

The malware deployed into the Orion Platform, known as Teardrop, was highly sophisticated, according to experts, and in addition to harvesting users’ credentials and monitoring their keystrokes...

MITRE ATT&CK® Techniques... Application Layer Protocol: Web Protocols [T1071.001]

This dropper then requested the download and execution of the second-stage WINELOADER.