H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[TEARDROP](https://attack.mitre.org/software/S0560) is a memory-only dropper that was discovered on some victim machines during investigations related to the [SolarWinds Compromise](https://attack.mitre.org/campaigns/C0024). It was likely used by [APT29](https://attack.mitre.org/groups/G0016) since at least May 2020.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Microsoft Deep Dive Solorigate January 2021)

Labels

malware

8 recorded

Relationships

uses

from APT29

Group

uses

from SolarWinds Compromise

Campaign

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Modify Registry

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Query Registry

Technique

uses

to Windows Service

Technique

3 external

References

mitre-attack

S0560

FireEye SUNBURST Backdoor December 2020

https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html

Microsoft Deep Dive Solorigate January 2021

https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/