Threat Signal Report

Latest CISA Malware Analysis Report for SolarWinds Activity (TEARDROP)

Description

FortiGuard Labs is aware of a new Malware Analysis Report (MAR-10320115-1.v1) released today by the Cybersecurity and Infrastructure Security Agency (CISA) related to the TEARDROP malware family used in the December SolarWinds attack. According to the report, TEARDROP is a loader designed to decrypt and execute an embedded payload on the target system. The payload has been identified as a Cobalt Strike beacon and provides a remote operator command and control capabilities over a victim's system through an encrypted network tunnel. The malware can perform data exfiltration, keylogging, take screenshots of a victim's machine, and deployment of payloads. Teardrop was the second stage payload of the SUNBURST attack, which likely allowed attackers to perform lateral movement and reconnaissance on an affected machine.

It is important to differentiate this from the SUPERNOVA malware analysis report of January 27th, which is a webshell backdoor, and was not used as part of the supply chain attack on SolarWinds.

For further details on SolarWinds, please refer to our Threat Signal posting from December.

What are the Technical Details of the Report?

The report provides technical descriptions of two malicious files used in this attack. According to details within the report, the first file is a dropper file that can read files and registry keys, decode an XOR embedded payload and then load it into memory. The file is persistent and will drop Cobalt Strike into memory.

The second file is a loader file. It is a 64-bit DLL file that will try to locate a predefined file in order to read the first 64 bytes of it. After it tries to read the file, it will then decrypt and execute an embedded code buffer which was observed to be the Cobalt Strike Beacon RAT (v4). Once established, it will then connect to a predetermined C2 server for further exfiltration.

Is This Limited to Targeted Attacks?

No.

How Serious of an Issue is This?

High.

What is the Status of Protections for this Event?

FortiGuard Labs has AV coverage in place for publicly available samples as:

Malicious_Behavior.SB

W64/TearDrop.A!tr

For FortiEDR protections, all publicly available IOC's were added to our Cloud intelligence and will be blocked if executed on customer systems.

Any Other Suggested Mitigation?

Due to the ease of disruption and due to the disruption and damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc. it is important to keep all AV and IPS signatures up to date.

It is also important to ensure that all known vendor vulnerabilities are addressed, and updated to protect from attackers having a foothold within a network. Attackers are well aware of the difficulty of patching and if it is determined that patching is not feasible at this time, an assessment should be conducted to determine the risk to the organization.

Also - organizations are encouraged to conduct ongoing training sessions to educate and inform personnel about the latest phishing/spearphishing attacks. They also need to encourage employees to never open attachments from someone they don't know, and to always treat emails from unrecognized/untrusted senders with caution. Since it has been reported that various phishing and spearphishing attacks have been delivered via social engineering distribution mechanisms, it is crucial that end users within an organization be made aware of the various types of attacks being delivered. This can be accomplished through regular training sessions and impromptu tests using predetermined templates by an organizations' internal security department. Simple user awareness training on how to spot emails with malicious attachments or links could also help prevent initial access into the network.