Heimdal
article featured image

Contents:

A threat group tracked as DEV-0950 was revealed to have used Clop ransomware to encrypt the network of victims previously infected with the Raspberry Robin worm.

In their most recent report, Microsoft Security Threat Intelligence analysts claim that Raspberry Robin worm has become part of a larger ecosystem opening doors for ransomware activity.

The Windows malware with worm capabilities via infected USB devices to other devices on a target’s network.

After the USB device containing a malicious .LNK file is attached and the link accessed, the worm will spawn a msiexec process using cmd to launch a second malicious file stored on the infected drive. On compromised Windows devices, it communicates with its command-and-control servers (C2).

According to BleepingComputer, Raspberry Robin has also been used to drop other second-stage payloads, including IcedID, Bumblebee, and Truebot.

In October 2022, Microsoft researchers observed Raspberry Robin infections followed by Cobalt Strike activity from DEV-0950. This activity, which in some cases included a Truebot infection, eventually deployed the Clop ransomware.

Source

According to Microsoft`s report, DEV-0950 traditionally uses phishing to trick their victims, so the shift towards Raspberry Robin means they can now deliver payloads to existing infections and move their campaigns more quickly to ransomware stages.

DEV-0950 malicious activity is said to coincide with cybercrime groups identified as FIN11 and TA505, known for deploying Clop ransomware on targets’ systems.

The number of affected organizations has reached 1000 over the course of a month.

Microsoft Defender for Endpoint data indicates that nearly 3,000 devices in almost 1,000 organizations have seen at least one Raspberry Robin payload-related alert in the last 30 days.

Source

If you liked this article, follow us on LinkedInTwitterFacebookYoutube, and Instagram for more cybersecurity news and topics.

Author Profile

Mihaela Popa

COMMUNICATIONS & PR OFFICER

Mihaela is a digital content creator for Heimdal® and the proud owner of an old soul and a curious mind. Passionate to learn and discover more about cybersecurity, she will gladly share her latest finds with you.

Leave a Reply

Your email address will not be published. Required fields are marked *

Protect your business by doing more with less

Book a Demo