COMMUNICATIONS & PR OFFICER

A threat group tracked as DEV-0950 was revealed to have used Clop ransomware to encrypt the network of victims previously infected with the Raspberry Robin worm.

In their most recent report, Microsoft Security Threat Intelligence analysts claim that Raspberry Robin worm has become part of a larger ecosystem opening doors for ransomware activity.

The Windows malware with worm capabilities via infected USB devices to other devices on a target’s network.

After the USB device containing a malicious .LNK file is attached and the link accessed, the worm will spawn a msiexec process using cmd to launch a second malicious file stored on the infected drive. On compromised Windows devices, it communicates with its command-and-control servers (C2).

According to BleepingComputer, Raspberry Robin has also been used to drop other second-stage payloads, including IcedID, Bumblebee, and Truebot.

In October 2022, Microsoft researchers observed Raspberry Robin infections followed by Cobalt Strike activity from DEV-0950. This activity, which in some cases included a Truebot infection, eventually deployed the Clop ransomware.

Source

According to Microsoft`s report, DEV-0950 traditionally uses phishing to trick their victims, so the shift towards Raspberry Robin means they can now deliver payloads to existing infections and move their campaigns more quickly to ransomware stages.

DEV-0950 malicious activity is said to coincide with cybercrime groups identified as FIN11 and TA505, known for deploying Clop ransomware on targets’ systems.

The number of affected organizations has reached 1000 over the course of a month.

Microsoft Defender for Endpoint data indicates that nearly 3,000 devices in almost 1,000 organizations have seen at least one Raspberry Robin payload-related alert in the last 30 days.

Source

If you liked this article, follow us on LinkedInTwitterFacebookYoutube, and Instagram for more cybersecurity news and topics.

Major Companies Affected by Ransomware [2022-2023]

Clop Ransomware Has Returned and Is Busier than Ever

Clop Ransomware: Overview, Operating Mode, and Prevention

Windows Installer Used by New Raspberry Robin Worm

Microsoft: Threat Actors Use Contact Forms on Websites to Deliver IcedID Malware

Leave a Reply

Your email address will not be published. Required fields are marked *

GO TO TOP