Microsoft: Raspberry Robin worm key facilitator of LockBit, Cl0p ransomware

Microsoft has published its investigation into Raspberry Robin, finding significant links between the worm and leading ransomware campaigns, as well as its key role in a wider malware ecosystem.

The current leading ransomware campaign, LockBit, has been shown to be in part facilitated by the Raspberry Robin worm and the now-shuttered Cl0p ransomware, which was another of the most prolific campaigns of 2021 and 2022, also used it to deploy payloads.

Researchers observed devices infected with Raspberry Robin being installed with the FakeUpdates malware in July 2022, leading to activity attributed to the threat actor tracked as DEV-0243 - a ransomware-associated group whose actions overlap with those of the group tracked as EvilCorp by other security researchers.

Raspberry Robin-infected devices were first noticed deploying LockBit ransomware payloads in November 2021 and has since been observed dropping samples of malware such as IcedID, Bumblebee, and Truebot too.

Additionally, Microsoft observed in October 2022 Raspberry Robin being used in post-compromise activity attributed to another actor, DEV-0950. The widely abused Cobalt Strike penetration testing tool was successfully dropped on victims after a Raspberry Robin infection and this ultimately also led to the deployment of Cl0p ransomware.

“DEV-0950 traditionally uses phishing to acquire the majority of their victims, so this notable shift to using Raspberry Robin enables them to deliver payloads to existing infections and move their campaigns more quickly to ransomware stages,” said Microsoft.

Microsoft's data indicated that nearly 3,000 devices in almost 1,000 organisations have seen at least one Raspberry Robin payload-related alert in the last 30 days.

Raspberry Robin was publicly disclosed in May 2022 by security firm Red Canary which branded it a widely distributed worm. Since then, it’s evolved into one of the largest malware distribution platforms currently active, Microsoft said.

Microsoft also said it’s possible that the actors behind the Raspberry Robin-related malware campaigns are paying the worm's operators to install malware that could lead to additional attacks.

"Raspberry Robin’s infection chain is a confusing and complicated map of multiple infection points that can lead to many different outcomes, even in scenarios where two hosts are infected simultaneously," said Microsoft.

"There are numerous components involved; differentiating them could be challenging as the attackers behind the threat have gone to extreme lengths to protect the malware at each stage with complex loading mechanisms. These attackers also hand off to other actors for some of the more impactful attack stages, such as ransomware deployment."

Microsoft also said it's currently aware of and tracking at least four entry vectors used by Raspberry Robin to infect victim machines - vectors that were linked to hands-on-keyboard activity from threat actors. The end goal of these actions was most likely the deployment of ransomware, it added.

The tech giant underlined that developing a robust protection and detection strategy and investing in credential hygiene, least privileges, and network segmentation are keys to preventing the impact of these complex threats.