Skip to content

Malware

BEATDROP

According to Mandiant, BEATDROP is a downloader written in C that uses Atlassian's project management service Trello for C&C.

BEATDROP is a Windows malware family operated by APT29.

Background

Mandiant describes BEATDROP as a C-language downloader that relies on Atlassian's Trello project-management service for command and control. It stores information about each victim on Trello and pulls down AES-encrypted shellcode from there, then injects and runs those payloads inside a suspended process. To execute shellcode within its own process, BEATDROP maps a fresh copy of ntdll.dll into memory, spawns a suspended thread via RtlCreateUserThread pointing at NtCreateFile, redirects execution to the shellcode, and resumes the thread. Each shellcode payload is tailored to a specific victim and is removed from Trello once it has been fetched.


Source: Malpedia (Fraunhofer FKIE).