Raspberry Robin

Description

Raspberry Robin is a worm that spreads through USB drives and is widely used to deliver other malware families such as IcedID and Clop. It infects Windows systems when users plug in contaminated media, and its staged loaders connect to command and control infrastructure that has persisted across many campaigns. Its spread in 7z, LNK, MSI, and other formats shows an operation that continually adapts its delivery formats to slip past defenses.

Stats

First seen: December 2022
Last seen: October 2026

Also known as

RaspberryRobinRaspberryrobin

MITRE ATT&CK techniques

41 techniques across 9 tactics.

TA0042 Resource Development

T1583Acquire Infrastructure
- T1583.001Domains
- T1583.008Malvertising

TA0002 Execution

T1047Windows Management Instrumentation
T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
T1204User Execution
T1559Inter-Process Communication
- T1559.001Component Object Model

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0004 Privilege Escalation

T1548Abuse Elevation Control Mechanism
- T1548.002Bypass User Account Control

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.002Software Packing
T1027Obfuscated Files or Information
- T1027.002Software Packing
T1036Masquerading
- T1036.004Masquerade Task or Service
- T1036.008Masquerade File Type
T1055Process Injection
- T1055.012Process Hollowing
T1070Indicator Removal
- T1070.004File Deletion
- T1070.009Clear Persistence
T1140Deobfuscate/Decode Files or Information
T1218System Binary Proxy Execution
- T1218.010Regsvr32
- T1218.008Odbcconf
- T1218.011Rundll32
- T1218.007Msiexec
T1480Execution Guardrails
T1497Virtualization/Sandbox Evasion
- T1497.001System Checks
T1574Hijack Execution Flow
- T1574.001DLL
T1622Debugger Evasion

TA0007 Discovery

T1033System Owner/User Discovery
T1057Process Discovery
T1082System Information Discovery
T1083File and Directory Discovery
T1518Software Discovery
- T1518.001Security Software Discovery

TA0008 Lateral Movement

T1091Replication Through Removable Media

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1071Application Layer Protocol
- T1071.001Web Protocols
T1102Web Service
T1105Ingress Tool Transfer
T1571Non-Standard Port

TA0112 Defense Impairment

T1685Disable or Modify Tools

Alert name variants

Alert Name	Engine
Document-HTML.Trojan.RaspberryRobin	ATP Sandbox Adv. Heuristics
Script-BAT.Trojan.RaspberryRobin	ATP Sandbox Adv. Heuristics
Shortcut.Trojan.Raspberryrobin	ATP Sandbox Adv. Heuristics
Trojan.RaspberryRobin.1.Gen	AV
Trojan.RaspberryRobin.2.Gen	ATP Sandbox Adv. HeuristicsAV
Win32.Backdoor.Raspberryrobin	ATP Sandbox Adv. Heuristics
Win32.Backdoor.RaspberryRobin	ATP Sandbox Adv. Heuristics
Win32.Trojan.Raspberryrobin	ATP Sandbox Adv. Heuristics
Win32.Trojan.RaspberryRobin	ATP Sandbox Adv. Heuristics