Raspberry Robin Worm Actors Linked to Clop, LockBit Ransomware Groups

The danger actors driving the Raspberry Robin worm have been linked with a intricate and interconnected malware ecosystem comprising the Clop and LockBit ransomware groups.

The findings appear from Microsoft, which has stated the worm had alternate an infection approaches over and above its first USB generate unfold.

“These bacterial infections guide to adhere to-on palms-on-keyboard assaults and human-operated ransomware activity,” Microsoft wrote in an advisory printed on Thursday.

According to the security specialists, Raspberry Robin (initially spotted by Red Canary in Could 2022) has evolved from getting a widely distributed worm with no noticed put up-infection steps to one particular of the largest malware distribution platforms presently active.

“In July 2022, Microsoft security scientists noticed products contaminated with Raspberry Robin currently being installed with the FakeUpdates malware, which led to DEV-0243 exercise,” the enterprise wrote, referring to a ransomware-centered risk actor with back links to EvilCorp, also believed to have deployed the LockBit ransomware in some campaigns.

Rapidly forward to Oct 2022, Microsoft said it noticed Raspberry Robin becoming applied in article-compromise exercise attributed to an additional actor, DEV-0950.

“From a Raspberry Robin infection, the DEV-0950 exercise led to Cobalt Strike arms-on-keyboard compromises, occasionally with a Truebot an infection observed in amongst the Raspberry Robin and Cobalt Strike phase,” Microsoft stated. “The exercise culminated in deployments of the Clop ransomware.”

The technology large has also extra that presented the interconnected character of the cyber-felony economic climate, the actors driving these Raspberry Robin-similar malware campaigns may be having to pay the Raspberry Robin operators for malware installs.

“Raspberry Robin’s infection chain is a baffling and complicated map of a number of infection factors that can direct to many unique results, even in eventualities exactly where two hosts are contaminated concurrently.”

Microsoft has said they believe that Raspberry Robin will most likely continue on to acquire and direct to far more malware distribution and cyber-felony exercise group relationships as its install footprint grows.

To assist companies defend against this risk, the business has provided detection specifics and indicators of compromise (IoC) in the advisory.

Its publication arrives times soon after a report by SonicWall advised a change in ransomware threats from the US and toward EMEA and APAC.

Some parts of this article are sourced from:
www.infosecurity-journal.com