Loading malware…
Raspberry Robin, also known as LNK Worm and QNAP Worm, is a Windows worm-like malware family used to establish initial access and distribute follow-on payloads. It commonly propagates through removable USB media containing malicious Windows shortcut files, and has also been observed via shared folders, archives, and ISO images. The shortcut-based infection chain uses legitimate Windows utilities to retrieve and execute subsequent malware stages, often from compromised network-attached storage infrastructure.
Raspberry Robin is heavily packed and incorporates extensive anti-analysis, anti-debugging, anti-virtualization, and sandbox-detection logic. It can deliver decoy payloads when analysis is detected while retaining the real payload for victim systems. The malware performs host and security-software discovery, uses Tor-based communications, injects a Tor client into suspended legitimate processes, and can abuse signed executables with malicious DLLs for defense evasion. Observed persistence mechanisms include RunOnce-style autoruns and scheduled tasks. Raspberry Robin has also used UAC-bypass techniques and contained selective local privilege-escalation exploits for CVE-2020-1054 and CVE-2021-1732.
The family has affected organizations across numerous sectors and regions, including government, telecommunications, industrial, and service-provider environments. It has served as a delivery vector for payloads including IcedID, Bumblebee, Truebot, SocGholish, Cobalt Strike, and in some intrusions activity that preceded Clop ransomware deployment. Reporting has identified possible operational links to financially motivated cybercrime ecosystems, including Evil Corp and Clop-related actors, but definitive attribution of Raspberry Robin’s operators remains unresolved.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The actors behind the recent Truebot campaign have shifted their delivery mechanism and are now exploiting a vulnerability in the on-premises and cloud-based IT system auditing software, Netwirx Auditor. The vulnerability, tracked as CVE-2022-31199 (CVSS: 9.8), is a Remote Code Execution (RCE) vulnerability that would enable a remote unauthenticated threat actor to execute code on vulnerable systems.
ZDI identified nearly 1,000 malicious .lnk files abusing ZDI-CAN-25373 (aka ZDI-25-148), a vulnerability that allows attackers to execute hidden malicious commands on a victim’s machine by leveraging crafted shortcut files. | An interesting observation we discovered while tracking these intrusion sets, and malware was that Water Asena (Evil Corp) had been exploiting ZDI-CAN-25373 in their Raspberry Robin campaigns.
CVE-2021-1732 is a win32k window object type confusion leading to an OOB (out-of-bounds) write. It was used as a 0-day in the wild by Bitter APT and written by Moses – also known as Exodus Intelligence. CVE-2021-1732 runs on Windows 10, with the targeted build number range being from 16353 to 19042. For the second exploit, it also checks if the package KB4601319 of the patch is present. | During the last year, Raspberry Robin has evolved to be one of the most distributed malware currently active. During this time, it is likely to be used by many actors to distribute their own malware such as IcedID, Clop ransomware and more.
CVE-2020-1054 is Win32k Elevation of Privilege Vulnerability reported by Check Point Research. The vulnerability is out of bounds write in win32k and it was used by different Exploit kits in the past. The exploit is only used by Raspberry Robin on Windows 7 systems where the revision number is not higher than 24552. | During the last year, Raspberry Robin has evolved to be one of the most distributed malware currently active. During this time, it is likely to be used by many actors to distribute their own malware such as IcedID, Clop ransomware and more.
"Raspberry Robin has added a new local privilege escalation (LPE) exploit (CVE-2024-38196) to gain elevated privileges on targeted systems."
9 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Lace Tempest "has been linked to GoAnywhere attacks and Raspberry Robin infection."
An interesting observation we discovered while tracking these intrusion sets, and malware was that Water Asena (Evil Corp) had been exploiting ZDI-CAN-25373 in their Raspberry Robin campaigns.
An interesting observation we discovered while tracking these intrusion sets, and malware was that Water Asena (Evil Corp) had been exploiting ZDI-CAN-25373 in their Raspberry Robin campaigns.
Microsoft says a threat group tracked as DEV-0950 used Clop ransomware to encrypt the network of a victim previously infected with the Raspberry Robin worm.
Microsoft on Friday disclosed a potential connection between the Raspberry Robin USB-based worm and an infamous Russian cybercrime group tracked as Evil Corp. Raspberry Robin, also called QNAP Worm, is known to spread from a compromised system via infected USB devices containing a malicious .LNK file to other devices in the target network.
"SocGholish has previously been seen delivering Raspberry Robin..."
29 distinct techniques documented for this family, organized by ATT&CK tactic.
With obfuscation removed, the LNK file contains a target similar to the format " cmd.exe /c start msiexec {URL} ".
Within the real payload is an embedded custom Tor client designed to communicate with the real payload using shared memory.
When the LNK file is double-clicked, the Windows Shell "opens" the shortcut file. In this case, "open" would mean "execute"
By exploiting this vulnerability, an attacker can prepare a malicious .lnk file for delivery to a victim.
It first attempts to read the registry value named “Active” at < HKEY_CURRENT_USER\SOFTWARE\Microsoft\Media >. This serves as an infection marker. If the read fails, it proceeds to write the string value “1” into this registry value
It then creates a suspended process, injects the code of the Tor client, resumes the process, and waits for data from the Tor client.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
In starting its Tor client process, the real payload randomly selects a name among these first: dllhost.exe regsvr32.exe rundll32.exe
It also sets the following registry entry to enable its automatic execution at system startup.
After dropping a copy of itself, it executes the dropped copy as Administrator using a UAC (User Account Contorl) bypass technique.
The content repeatedly describes malware and threat actors that 'bypass UAC,' 'perform UAC bypass,' or use specific Windows components such as fodhelper.exe, eventvwr.exe, sdclt.exe, CMSTPLUA COM interface, SilentCleanup, and registry hijacks to gain elevated privileges.
The main payload itself is packed with more than 10 layers for obfuscation and is capable of delivering a fake payload once it detects sandboxing and security analytics tools.
If it is not in Session 0, it drops a copy of itself in < %ProgramData%\{random folder name}\{random file name}.{extension} > ... The extension name is randomly chosen among the following: .bak .dat .db .dmp .etl .idx .json .lkg .lock log .man .tmp txt .vdm .xml .xsd
It then creates a suspended process, injects the code of the Tor client, resumes the process, and waits for data from the Tor client.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
The LNK file contains a command line that runs a legitimate executable to download a Windows Installer (MSI) package. This legitimate executable is usually msiexec.exe, but we have also seen wmic.exe used in other samples.
The LNK file contains a command line that runs a legitimate executable to download a Windows Installer (MSI) package. This legitimate executable is usually msiexec.exe
AppleSeed can call regsvr32.exe for execution. APT19 used Regsvr32 to bypass application control techniques. APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory.
To persist on the infected system, Raspberry Robin uses a registry key to automatically load a malicious module through the Windows binary “rundll32.exe”
it loads the fake payload once it detects sandboxing tools to evade security and analytics tools from detecting and studying the malware's real routine.
it then gathers system information: the computer name, current username, processor brand, and display device names.
it loads the fake payload once it detects sandboxing tools to evade security and analytics tools from detecting and studying the malware's real routine.
In several instances, Darktrace observed Raspberry Robin utilizing TOR exit notes as backup C2 infrastructure, with compromised devices detected connecting to TOR endpoints. | In all cases investigated by Darktrace, compromised devices were detected making HTTP GET connections via the unusual port 8080 to Raspberry Robin C2 endpoints using the new user agent 'Windows Installer'.
66 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
92 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Lace Tempest "has been linked to GoAnywhere attacks and Raspberry Robin infection."
Named malware infection historically linked to Lace Tempest; the content provides no further behavioral details.
Raspberry Robin is referenced as the malware used in campaigns by Water Asena (Evil Corp) that exploited the ZDI-CAN-25373 Windows shortcut vulnerability.
A malware family spread through infected removable media such as USB drives and often used to provide initial access for ransomware operators.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.