Raindrop

Internal ID: win.raindrop

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Raindrop is a loader for Cobalt Strike that was observed in the SolarWinds attack.

Threat Analysis

Raindrop is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.bushidotoken.net/2022/07/space-invaders-cyber-threats-that-are.html

→https://file2.api.drift.com/download/drift-prod-file-uploads/417f%2F417f74ae8ddd24aa7c2b43a23093983f/Supply%20Chain%20Attacks_%20Cyber%20Criminals%20Target%20the%20Weakest%20Link.pdf

→https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf

→https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware

→https://symantec.broadcom.com/hubfs/Attacks-Against-Government-Sector.pdf

→https://www.mandiant.com/resources/unc2452-merged-into-apt29

→https://www.sans.org/webcasts/contrarian-view-solarwinds-119515

→https://www.youtube.com/watch?v=GfbxHy6xnbA

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.raindrop

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Raindrop