Researchers Warn of a Dangerous Raspberry Robin Worm Targeting Windows Users
A relatively new kind of Windows worm, known as Raspberry Robin, has been spreading from victim to victim across Europe, mainly via USB devices. Red Canary intelligence analysts initially discovered this worm in September 2021, and have warned Windows users of its potential threat to their devices.
USB Devices Are the Main Target of Raspberry Robin
The main vehicle of transfer for the Raspberry Robin worm is USB devices. An infected device will show the victim a .LNK file upon insertion, which infects the device through the command prompt via the creation of a msiexec process (known as msiexec.exe). A BAT file is also present in infected devices, which contains two commands.
Two additional Windows tools are being exploited by Raspberry Robin: fodhelper.exe and odbcconf.exe. While both are executable files, the former is used to manage Windows features, while the latter is used for the configuration of ODBC (Open Database Connectivity) drivers. Leveraging these three different files allows Raspberry Robin to be less easily detectable. This malware also usesTOR exit nodesto communicate with the rest of its ecosystem, which also makes it trickier to spot.
QNAP NAS Devices Also a Raspberry Robin Target
Compromised QNAP NAS (Network-Attached Storage) devices are also exploited in the Raspberry Robin infection process, wherein the attacker uses HTTP requests that contain the victim’s user and device names after the .LNK file is downloaded. The worm uses a malicious DLL (Dynamic-Link Library) from a compromised QNAP device to gain access to and control over one’s system.QNAP devices have been exploited by attackers in the pastfor various reasons, particularly malware infection.
There’s Still Lots More to Learn About Raspberry Robin
Raspberry Robin targets Windows users specifically, and hundreds of devices have already been affected. At the moment, it is still not known how Raspberry Robin spreads from one USB drive to the next, which is a concern in terms of infection mitigation. In a post onthe Red Canary Blog, the company claims that they are dealing with “several intelligence gaps” around this wave of Raspberry Robin attacks, including the overall intention of the malware’s operators.
Be Wary When Inserting USB Drives Into Your Computer
Raspberry Robin’s dynamics and objectives are still not totally understood, which makes it harder for us to determine the true purpose and future of this malware. Windows users must therefore be vigilant about the USB drives that they choose to insert into any of their devices.
Looking to encrypt your USB drive? Here are the best programs you can use.
The best features aren’t the ones being advertised.
It’s not super flashy, but it can help to keep your computer up and running.
Revolutionize your driving experience with these game-changing CarPlay additions.
Unlock a world of entertainment possibilities with this clever TV hack.
Your phone’s camera app doesn’t show this, so it’s easy to miss.
Technology Explained
PC & Mobile
