Loading story…
Check Point Research reported that Raspberry Robin continues to evolve as a malware delivery and initial-access operation by rapidly incorporating newly disclosed 1-day vulnerabilities into its campaigns. The activity shows the threat actor using fresh exploits soon after public disclosure, allowing it to compromise targets before many organizations have fully patched exposed systems and reinforcing Raspberry Robin’s role as a persistent access broker in the cybercrime ecosystem.
The report indicates that Raspberry Robin has remained active by pairing exploit-driven intrusion techniques with broader malware distribution infrastructure, helping it maintain footholds and enable follow-on malicious activity. The continued use of recently disclosed flaws highlights the operational risk posed by delayed patching and internet-facing exposure, as defenders face an adversary that repeatedly adapts its infection chains to capitalize on short windows between vulnerability disclosure and remediation.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Check Point Research published a report describing Raspberry Robin's continued use of newly disclosed one-day vulnerabilities as part of its operations. The reference indicates technical details about the threat actor's exploitation patterns were publicly revealed in this analysis.
Microsoft stated in a private threat intelligence advisory that the Raspberry Robin worm had compromised the networks of hundreds of organizations. The advisory marked a notable escalation in publicly understood impact beyond earlier technical reporting on the malware's infection chain.
Red Canary published a technical analysis of the Raspberry Robin worm, detailing its spread via infected removable drives and malicious .lnk files, use of msiexec.exe for command-and-control, and later-stage execution and network behaviors. The report also documented infrastructure characteristics and behavior-based detection opportunities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
research.checkpoint.com
Open sourcefourcore.io
Open sourceredcanary.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft and multiple security firms reported that **Raspberry Robin** evolved from a USB-spreading worm into a broader malware delivery platform used to stage ransomware intrusions. The malware typically arrives through infected removable media or shared files containing malicious `.LNK` shortcuts, then abuses legitimate Windows tools such as `cmd.exe`, `msiexec.exe`, `rundll32.exe`, `regsvr32.exe`, and `fodhelper.exe` to download and launch payloads while evading detection. Researchers tied its infrastructure to short algorithmic domains, HTTP over port `8080`, compromised **QNAP** and other IoT devices, and Tor-based command-and-control, while also documenting heavy obfuscation, sandbox evasion, persistence in `ProgramData` and similar paths, and privilege-escalation techniques including UAC bypasses. Follow-on activity linked Raspberry Robin infections to payloads including **FakeUpdates/SocGholish, IcedID, Bumblebee, Truebot, Fauppod, Grace, and Cobalt Strike**, with Microsoft saying the access was later used in **Clop** ransomware attacks and showed overlaps with **FIN11/TA505** and possible **Evil Corp** pre-ransomware behavior. Victims spanned government, telecommunications, finance, manufacturing, retail, education, transportation, and industrial sectors across Europe, Latin America, Australia, and elsewhere, underscoring its role in a criminal ecosystem where initial access is likely brokered to other operators for data theft, reconnaissance, and ransomware deployment.
Aug 15, 2026
**RondoDox** has expanded into a large-scale botnet campaign that targets **174 vulnerabilities** across a wide range of internet-exposed devices, with researchers observing up to **15,000 daily exploitation attempts**. Reporting based on **Bitsight** telemetry says the botnet, active since 2025 and built on a **Mirai** code base, is more focused than typical Mirai-derived operations: it is geared toward **denial-of-service activity** and supports **18 architectures**, enabling attacks against routers, DVRs, NVRs, CCTV systems, web servers, and other embedded or Linux-based hardware. Analysts mapped **148 exploits to CVEs**, identified **15 public PoCs without CVEs**, and found **11 exploits with no public PoC**, indicating active exploit collection and rapid weaponization of newly disclosed flaws. The campaign has evolved from earlier exploitation of **TP-Link Archer AX21** flaw `CVE-2023-1389` and later abuse of `CVE-2024-3721`, `CVE-2024-12856`, and the **React2Shell** issue `CVE-2025-55182` affecting **Next.js** servers. Researchers also reported that the operators use **residential IP infrastructure** and traffic patterns that mimic gaming or VPN services to reduce detection, while showing the ability to deploy some exploits within days of disclosure and, in at least one case, exploit `CVE-2025-62593` before its CVE record was formally published. This activity reflects a sustained, strategically managed botnet operation rather than opportunistic scanning, with broad exploit coverage and infrastructure choices designed to improve reach and resilience.
Jun 29, 2026
The RondoDox botnet has emerged as a significant threat, actively targeting a wide array of internet-exposed infrastructure by exploiting over 50 known vulnerabilities, many of which were first disclosed during Pwn2Own hacking competitions. Security researchers from Trend Micro and FortiGuard Labs have observed the botnet leveraging an 'exploit shotgun' approach, simultaneously deploying numerous exploits to maximize infection rates across diverse device types. The campaign has been active globally since at least June 2025, with attacks focusing on routers, digital video recorders (DVRs), network video recorders (NVRs), CCTV systems, web servers, and other network devices from more than 30 vendors. Notably, the botnet exploits both recent and older vulnerabilities, including CVE-2023-1389 in the TP-Link Archer AX21 Wi-Fi router, which was originally demonstrated at Pwn2Own Toronto 2022 and previously targeted by Mirai. The list of exploited vulnerabilities includes CVE-2024-3721, CVE-2024-12856, and many others affecting brands such as Digiever, QNAP, LB-LINK, TRENDnet, D-Link, TBK, Four-Faith, Netgear, AVTECH, TOTOLINK, Tenda, Meteobridge, Edimax, and Linksys. Many of these vulnerabilities are now included in CISA’s Known Exploited Vulnerabilities (KEV) catalog, underscoring the urgency for organizations to patch affected systems. Devices that have reached end-of-life are particularly at risk, as they are less likely to receive security updates, making them attractive targets for the botnet operators. The campaign exposes organizations to risks including data exfiltration, persistent network compromise, and operational disruption, especially for those with internet-facing infrastructure. Security experts recommend prioritizing the patching of all listed vulnerabilities, conducting regular vulnerability assessments, segmenting networks to limit lateral movement, and continuously monitoring for anomalous device activity. Trend Micro has indicated that its solutions provide protection against the vulnerabilities exploited by RondoDox, offering mitigation while patching is underway. The rapid weaponization of vulnerabilities demonstrated at Pwn2Own highlights the need for organizations to monitor disclosures from such competitions and act swiftly to secure their environments. The RondoDox botnet’s ability to quickly expand its arsenal of exploits demonstrates a high level of adaptability and threat actor sophistication. The campaign’s global reach and the diversity of targeted devices suggest that organizations across multiple sectors are at risk. The use of mass n-day exploitation, rather than relying solely on zero-day vulnerabilities, allows the botnet to compromise a large number of devices that may not be promptly patched. Security researchers emphasize the importance of defense-in-depth strategies to mitigate the impact of such widespread exploitation campaigns. The ongoing activity of RondoDox serves as a stark reminder of the persistent threat posed by botnets leveraging known vulnerabilities in widely deployed network devices.
Jun 29, 2026