Raspberry Robin Worm Strikes Again, Targeting Telecom and Government Systems

Dec 21, 2022Ravie Lakshmanan

The Raspberry Robin worm has been used in
attacks against telecommunications and government office systems
across Latin America, Australia, and Europe since at least
September 2022.

“The main payload itself is packed with more than 10 layers for
obfuscation and is capable of delivering a fake payload once it
detects sandboxing and security analytics tools,” Trend Micro
researcher Christopher So said^[1]
in a technical analysis published Tuesday.

A majority of the infections have been detected in Argentina,
followed by Australia, Mexico, Croatia, Italy, Brazil, France,
India, and Colombia.

Raspberry Robin, attributed to an activity cluster tracked by
Microsoft as DEV-0856^[2], is being increasingly
leveraged by multiple threat
actors^[3] as an initial access
mechanism to deliver payloads such as LockBit^[4]
and Clop^[5]
ransomware.

The malware is known for relying on infected USB drives as a
distribution vector to download a rogue MSI installer file that
deploys the main payload responsible for facilitating
post-exploitation.

Further analysis of Raspberry Robin reveals the use of heavy
obfuscation to prevent analysis, with the malware “composed of two
payloads embedded in a payload loader packed six times.”

The payload loader, for its part, is orchestrated to load the
decoy payload, an adware dubbed BrowserAssistant, to throw off
detection efforts.

Should no sandboxing and analysis be observed, the legitimate
payload is installed and proceeds to connect to a hard-coded .onion
address using a custom TOR client embedded within it to await
further commands.

The TOR client process masquerades as legitimate Windows
processes like dllhost.exe, regsvr32.exe, and rundll32.exe, once
again underscoring the considerable efforts made by the threat
actor to fly under the radar.

What’s more, the malware’s real routine is run in Session 0^[6], a specialized Windows session^[7] reserved for services
and other non-interactive user applications to mitigate security
risks such as shatter attacks^[8].

Trend Micro said it found similarities in a privilege escalation
and an anti-debugging technique used by Raspberry Robin and LockBit
ransomware, hinting at a potential connection between the two
criminal actors.

“The group behind Raspberry Robin is the maker of some of the
tools LockBit is also using,” the company theorized, adding it
alternatively “availed of the services of the affiliate responsible
for the techniques used by LockBit.”

That having said, the intrusions appear to be a reconnaissance
operation, as no data is returned from the TOR domain, suggesting
that the group behind the malware is “testing the waters to see how
far its deployments can spread.”