Raspberry Robin Malware Detection: Enhanced Worm-Like Version Attacking European Financial Institutions

No matter the holiday season, adversaries have no vacation inventing new malicious tricks to target unsuspecting victims. Last week, security researchers uncovered an enhanced variant of the worm-like Raspberry Robin malware dropper leveraged to target financial and insurance companies across European countries. Experts specifically note that Rasperry Robin received a significant upgrade, including complex obfuscation and anti-analysis features, sophisticated downloading mechanism and data encryption capabilities, and more.

Detect Raspberry Robin Malware 

The latest Raspberry Robin upgrade is a wake-up call for security practitioners globally. This malicious framework is considered one of the largest malware distribution platforms in the arena, broadly adopted by ransomware operators and other financially-motivated actors. 

To help security practitioners proactively defend against potential intrusions, SOC Prime’s Detection as Code platform offers a batch of dedicated Sigma rules to detect Raspberry Robin, including those to identify malicious activity related to the latest malware iteration. 

Hit the Explore Detections buttons below to access the full list of relevant detection content, accompanied by extensive metadata and CTI references. All the detection content is compatible with 25+ SIEM, EDR, BDP, and XDR solutions and is mapped to MITRE ATT&CK® framework v12.

Explore Detections

Raspberry Robin Worm: Analysis of the Upgraded Malware Used in the Latest Campaigns

Raspberry Robin backdoor designed as a malware loader is a worm that infects targeted systems via Trojanized USB devices. Malware has been spotted in the cyber threat landscape since mid-May 2022 continuously expanding the scope of its attacks and evolving the malicious strains with new variants coming on the scene. In July 2022, Microsoft cybersecurity researchers linked the Raspberry Robin backdoor to the russia-backed hacking collective tracked as Evil Corp, which was behind cyber attacks against financial institutions spreading Dridex malware. Raspberry Robin has been considered Evil Corp-linked malware due to its striking resemblance to the Dridex malware loader.

At the turn of 2022, cybersecurity researchers discovered tricky behavior patterns associated with the Raspberry Robin distribution, which involved malicious attempts to drop a fraudulent payload to evade detection. This novel adversary tactic was applied in one of the latest Raspberry Robin campaigns targeting telecom companies and government entities.  

The latest versions of the worm-like backdoor leverage advanced obfuscated techniques to hinder anti-malware analysis, which poses new challenges to cyber defenders. Cybersecurity researchers indicate that hackers are now leveraging the most sophisticated version of Raspberry Robin in their latest malicious campaigns targeting Spanish and Portuguese-language-based financial organizations. According to the report by Security Joes, the upgraded malware variant enables threat actors to take advantage of post-infection capabilities for detection evasion, to move laterally, and to exploit the cloud infrastructures of popular web services and platforms, including Discord, Azure, and GitHub.

The latest framework version involves more advanced capabilities with at least five layers of protection prior to the malicious code deployment. The most recent malware iteration also applies a robust RC4-encrypted payload for C2 beaconing, which has replaced a previous less complex version.

The fact that Raspberry Robin operators have started collecting information about their victims exacerbates the risks of potential malware attacks. The increased sophistication of the latest backdoor version and its constantly enhanced offensive capabilities requires ultra-responsiveness from defenders. To proactively defend against all related attacks, security experts are welcome to reach a comprehensive list of Sigma rules to detect Dridex that bears multiple similarities with Raspberry Robin in terms of the malware structure and functionality.