Loading malware…
Raspberry Robin is a Windows worm and malware distribution platform known for spreading primarily through infected removable media, especially USB drives containing malicious shortcut files. It has also been referred to as QNAP Worm and LNK Worm. The malware typically abuses legitimate Windows utilities such as cmd.exe and msiexec.exe to launch its infection chain, retrieve additional components, and reduce visibility. Multiple investigations have also documented delivery through shared folders, archives, ISO files, and DLL side-loading chains involving legitimate signed executables paired with malicious DLLs.
After execution, Raspberry Robin commonly downloads and runs additional payload components, establishes persistence, and sets up command-and-control communications through Tor. It has been observed using regsvr32.exe, rundll32.exe, dllhost.exe, and related native binaries in unusual ways, including process injection into suspended legitimate processes to host an embedded Tor client. The malware is heavily obfuscated and incorporates extensive anti-analysis, anti-debugging, anti-sandbox, and anti-virtualization logic. Some variants can deliver fake or decoy payloads when analysis conditions are detected, while preserving the real payload for genuine victims.
Raspberry Robin has demonstrated privilege-escalation and defense-evasion behavior, including abuse of fodhelper.exe for UAC bypass, security software discovery, removal or manipulation of defensive settings, and DLL side-loading to bypass controls. Reporting has also documented persistence via RunOnce or RunOnceEx mechanisms and scheduled tasks. More advanced research has identified embedded local privilege-escalation exploit capability in some samples, indicating rapid operational evolution.
The malware is notable for its role as an access broker and delivery vector for other malware families and post-compromise tooling. Observed follow-on payloads and activity have included IcedID, Bumblebee, TrueBot, FakeUpdates, Cobalt Strike, and Clop ransomware. Microsoft has reported intrusions in which Raspberry Robin infections preceded Clop deployment, and other reporting has noted possible ecosystem links involving Evil Corp-associated activity, although definitive attribution of Raspberry Robin itself remains unresolved. Victimology has included government, telecommunications, manufacturing, finance, retail, education, transportation, industrial, and service-provider environments across Europe, Latin America, Australia, and other regions.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2021-1732 is a win32k window object type confusion leading to an OOB (out-of-bounds) write. It was used as a 0-day in the wild by Bitter APT and written by Moses – also known as Exodus Intelligence. CVE-2021-1732 runs on Windows 10, with the targeted build number range being from 16353 to 19042. For the second exploit, it also checks if the package KB4601319 of the patch is present. | During the last year, Raspberry Robin has evolved to be one of the most distributed malware currently active. During this time, it is likely to be used by many actors to distribute their own malware such as IcedID, Clop ransomware and more.
CVE-2020-1054 is Win32k Elevation of Privilege Vulnerability reported by Check Point Research. The vulnerability is out of bounds write in win32k and it was used by different Exploit kits in the past. The exploit is only used by Raspberry Robin on Windows 7 systems where the revision number is not higher than 24552. | During the last year, Raspberry Robin has evolved to be one of the most distributed malware currently active. During this time, it is likely to be used by many actors to distribute their own malware such as IcedID, Clop ransomware and more.
newer versions allow cyber threat actors to also gain initial access through exploiting CVE-2022-31199—(a remote code execution vulnerability in the Netwrix Auditor application)... cyber threat actors have shifted tactics, exploiting, in observable manner, a remote code execution vulnerability (CVE-2022-31199) in Netwrix Auditor | Raspberry Robin has evolved into one of the largest malware distribution platforms and has been observed deploying Truebot, as well as other post-compromise payloads such as IcedID and Bumblebee malware.
"Raspberry Robin has added a new local privilege escalation (LPE) exploit (CVE-2024-38196) to gain elevated privileges on targeted systems."
8 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Microsoft says a threat group tracked as DEV-0950 used Clop ransomware to encrypt the network of a victim previously infected with the Raspberry Robin worm.
Microsoft says a threat group tracked as DEV-0950 used Clop ransomware to encrypt the network of a victim previously infected with the Raspberry Robin worm.
Microsoft on Friday disclosed a potential connection between the Raspberry Robin USB-based worm and an infamous Russian cybercrime group tracked as Evil Corp. Raspberry Robin, also called QNAP Worm, is known to spread from a compromised system via infected USB devices containing a malicious .LNK file to other devices in the target network.
Microsoft says a threat group tracked as DEV-0950 used Clop ransomware to encrypt the network of a victim previously infected with the Raspberry Robin worm.
"SocGholish has previously been seen delivering Raspberry Robin..."
Raspberry Robin: A complex worm, initially spread via “Bad USB” attacks, which Microsoft observed pushing the SocGholish on-device agent.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
With obfuscation removed, the LNK file contains a target similar to the format " cmd.exe /c start msiexec {URL} ".
Within the real payload is an embedded custom Tor client designed to communicate with the real payload using shared memory.
When the LNK file is double-clicked, the Windows Shell "opens" the shortcut file. In this case, "open" would mean "execute"
Once the user connects the infected USB to the system, Raspberry Robin initially arrives as a shortcut or LNK file.
It first attempts to read the registry value named “Active” at < HKEY_CURRENT_USER\SOFTWARE\Microsoft\Media >. This serves as an infection marker. If the read fails, it proceeds to write the string value “1” into this registry value
It then creates a suspended process, injects the code of the Tor client, resumes the process, and waits for data from the Tor client.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
In starting its Tor client process, the real payload randomly selects a name among these first: dllhost.exe regsvr32.exe rundll32.exe
It also sets the following registry entry to enable its automatic execution at system startup.
After dropping a copy of itself, it executes the dropped copy as Administrator using a UAC (User Account Contorl) bypass technique.
The content repeatedly describes malware and threat actors that 'bypass UAC,' 'perform UAC bypass,' or use specific Windows components such as fodhelper.exe, eventvwr.exe, sdclt.exe, CMSTPLUA COM interface, SilentCleanup, and registry hijacks to gain elevated privileges.
The main payload itself is packed with more than 10 layers for obfuscation and is capable of delivering a fake payload once it detects sandboxing and security analytics tools.
If it is not in Session 0, it drops a copy of itself in < %ProgramData%\{random folder name}\{random file name}.{extension} > ... The extension name is randomly chosen among the following: .bak .dat .db .dmp .etl .idx .json .lkg .lock log .man .tmp txt .vdm .xml .xsd
It then creates a suspended process, injects the code of the Tor client, resumes the process, and waits for data from the Tor client.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
The LNK file contains a command line that runs a legitimate executable to download a Windows Installer (MSI) package. This legitimate executable is usually msiexec.exe, but we have also seen wmic.exe used in other samples.
The LNK file contains a command line that runs a legitimate executable to download a Windows Installer (MSI) package. This legitimate executable is usually msiexec.exe
AppleSeed can call regsvr32.exe for execution. APT19 used Regsvr32 to bypass application control techniques. APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory.
To persist on the infected system, Raspberry Robin uses a registry key to automatically load a malicious module through the Windows binary “rundll32.exe”
it loads the fake payload once it detects sandboxing tools to evade security and analytics tools from detecting and studying the malware's real routine.
it then gathers system information: the computer name, current username, processor brand, and display device names.
it loads the fake payload once it detects sandboxing tools to evade security and analytics tools from detecting and studying the malware's real routine.
In several instances, Darktrace observed Raspberry Robin utilizing TOR exit notes as backup C2 infrastructure, with compromised devices detected connecting to TOR endpoints. | In all cases investigated by Darktrace, compromised devices were detected making HTTP GET connections via the unusual port 8080 to Raspberry Robin C2 endpoints using the new user agent 'Windows Installer'.
66 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
87 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware family spread through infected removable media such as USB drives and often used to provide initial access for ransomware operators.
Named in the article as one of the malware families associated with SocGholish follow-on activity.
Mentioned as a campaign previously associated with similar MSIEXEC-based behavior.
Worm deployed through malicious LNK files, specifically via infected USB media.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.