IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Microsoft: Raspberry Robin worm key facilitator of LockBit, Cl0p ransomware

The worm was first reported in May 2022 and has evolved into one of the largest malware distribution platforms currently active

Microsoft has published its investigation into Raspberry Robin, finding significant links between the worm and leading ransomware campaigns, as well as its key role in a wider malware ecosystem.

The current leading ransomware campaign, LockBit, has been shown to be in part facilitated by the Raspberry Robin worm and the now-shuttered Cl0p ransomware, which was another of the most prolific campaigns of 2021 and 2022, also used it to deploy payloads.

Related Resource

Building a better password strategy for your business

Exploring the strategies and exploits that hackers are using to circumvent password security measures

Whitepaper cover with title in block red box and image of keyboard keys, with a padlock and finger printFree Download

Researchers observed devices infected with Raspberry Robin being installed with the FakeUpdates malware in July 2022, leading to activity attributed to the threat actor tracked as DEV-0243 - a ransomware-associated group whose actions overlap with those of the group tracked as EvilCorp by other security researchers.

Raspberry Robin-infected devices were first noticed deploying LockBit ransomware payloads in November 2021 and has since been observed dropping samples of malware such as IcedID, Bumblebee, and Truebot too.

Additionally, Microsoft observed in October 2022 Raspberry Robin being used in post-compromise activity attributed to another actor, DEV-0950. The widely abused Cobalt Strike penetration testing tool was successfully dropped on victims after a Raspberry Robin infection and this ultimately also led to the deployment of Cl0p ransomware.

“DEV-0950 traditionally uses phishing to acquire the majority of their victims, so this notable shift to using Raspberry Robin enables them to deliver payloads to existing infections and move their campaigns more quickly to ransomware stages,” said Microsoft.

Microsoft's data indicated that nearly 3,000 devices in almost 1,000 organisations have seen at least one Raspberry Robin payload-related alert in the last 30 days.

Raspberry Robin was publicly disclosed in May 2022 by security firm Red Canary which branded it a widely distributed worm. Since then, it’s evolved into one of the largest malware distribution platforms currently active, Microsoft said.

Microsoft also said it’s possible that the actors behind the Raspberry Robin-related malware campaigns are paying the worm's operators to install malware that could lead to additional attacks.

"Raspberry Robin’s infection chain is a confusing and complicated map of multiple infection points that can lead to many different outcomes, even in scenarios where two hosts are infected simultaneously," said Microsoft.

"There are numerous components involved; differentiating them could be challenging as the attackers behind the threat have gone to extreme lengths to protect the malware at each stage with complex loading mechanisms. These attackers also hand off to other actors for some of the more impactful attack stages, such as ransomware deployment."

Microsoft also said it's currently aware of and tracking at least four entry vectors used by Raspberry Robin to infect victim machines - vectors that were linked to hands-on-keyboard activity from threat actors. The end goal of these actions was most likely the deployment of ransomware, it added.

The tech giant underlined that developing a robust protection and detection strategy and investing in credential hygiene, least privileges, and network segmentation are keys to preventing the impact of these complex threats.

Featured Resources

AI for customer service

IBM Watson Assistant solves customer problems the first time

View now

Solve cyber resilience challenges with storage solutions

Fundamental capabilities of cyber-resilient IT infrastructure

Free Download

IBM FlashSystem 5000 and 5200 for mid-market enterprises

Manage rapid data growth within limited IT budgets

Free download

Leverage automated APM to accelerate CI/CD and boost application performance

Constant change to meet fast-evolving application functionality

Free Download

Recommended

Windows users now able to run Linux apps and distros natively
Microsoft Windows

Windows users now able to run Linux apps and distros natively

24 Nov 2022
Microsoft issues emergency fixes for wide-reaching Kerberos issues
Software

Microsoft issues emergency fixes for wide-reaching Kerberos issues

21 Nov 2022
Microsoft targets optimised supply chain investments with new platform launch
Business operations

Microsoft targets optimised supply chain investments with new platform launch

16 Nov 2022
Microsoft says “it’s just too difficult” to effectively disrupt ransomware
Security

Microsoft says “it’s just too difficult” to effectively disrupt ransomware

4 Nov 2022

Most Popular

The top 12 password-cracking techniques used by hackers
Security

The top 12 password-cracking techniques used by hackers

14 Nov 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

15 Nov 2022
Google rolls out patch for high-severity Chrome browser zero day
zero-day exploit

Google rolls out patch for high-severity Chrome browser zero day

25 Nov 2022