MITRE ATT&CKsoftware (malware)

S1130 Raspberry Robin

Published 2024-05-17 Modified 2024-07-23 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.0
Created
2024-05-17

Description

Raspberry Robin is initial access malware first identified in September 2021, and active through early 2024. The malware is notable for spreading via infected USB devices containing a malicious LNK object that, on execution, retrieves remote hosted payloads for installation. Raspberry Robin has been widely used against various industries and geographies, and as a precursor to information stealer, ransomware, and other payloads such as SocGholish, Cobalt Strike, IcedID, and Bumblebee. The DLL componenet in the Raspberry Robin infection chain is also referred to as "Roshtyak." The name "Raspberry Robin" is used to refer to both the malware as well as the threat actor associated with its use, although the Raspberry Robin operators are also tracked as Storm-0856 by some vendors.

Related

Uses · MITRE ATT&CK (41)

  • T1685 Disable or Modify Tools technique
  • T1036.008 Masquerade File Type sub-technique
  • T1583.008 Malvertising sub-technique
  • T1070.009 Clear Persistence sub-technique
  • T1622 Debugger Evasion technique
  • T1583.001 Domains sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1571 Non-Standard Port technique
  • T1574.001 DLL sub-technique
  • T1574 Hijack Execution Flow technique
  • T1059.003 Windows Command Shell sub-technique
  • T1497.001 System Checks sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1559 Inter-Process Communication technique
  • T1559.001 Component Object Model sub-technique
  • T1036.004 Masquerade Task or Service sub-technique
  • T1027.002 Software Packing sub-technique
  • T1070.004 File Deletion sub-technique
  • T1548 Abuse Elevation Control Mechanism technique
  • T1548.002 Bypass User Account Control sub-technique
  • T1218.007 Msiexec sub-technique
  • T1218.008 Odbcconf sub-technique
  • T1218.010 Regsvr32 sub-technique
  • T1218.011 Rundll32 sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1055.012 Process Hollowing sub-technique
  • T1497 Virtualization/Sandbox Evasion technique
  • T1480 Execution Guardrails technique
  • T1204 User Execution technique
  • T1140 Deobfuscate/Decode Files or Information technique
Show all 41 ›

References