H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Raindrop

[Raindrop](https://attack.mitre.org/software/S0565) is a loader used by [APT29](https://attack.mitre.org/groups/G0016) that was discovered on some victim machines during investigations related to the [SolarWinds Compromise](https://attack.mitre.org/campaigns/C0024). It was discovered in January 2021 and was likely used since at least May 2020.(Citation: Symantec RAINDROP January 2021)(Citation: Microsoft Deep Dive Solorigate January 2021)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Raindrop](https://attack.mitre.org/software/S0565) is a loader used by [APT29](https://attack.mitre.org/groups/G0016) that was discovered on some victim machines during investigations related to the [SolarWinds Compromise](https://attack.mitre.org/campaigns/C0024). It was discovered in January 2021 and was likely used since at least May 2020.(Citation: Symantec RAINDROP January 2021)(Citation: Microsoft Deep Dive Solorigate January 2021)

Labels

malware
9 recorded

Relationships

uses
from APT29
Group
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Encrypted/Encoded File
Technique
uses
to Masquerading
Technique
uses
to Match Legitimate Resource Name or Location
Technique
uses
to Software Packing
Technique
uses
to Steganography
Technique
uses
to Time Based Checks
Technique
uses
from SolarWinds Compromise
Campaign
4 external

References

mitre-attack
S0565
open
Raindrop
—
Microsoft Deep Dive Solorigate January 2021
https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
open
Symantec RAINDROP January 2021
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance