Raspberry Robin Worm Targets Telcos & GovernmentsRaspberry Robin Worm Targets Telcos & Governments
With 10 layers of obfuscation and fake payloads, the Raspberry Robin worm is nesting its way deep into organizations.
December 20, 2022
It's likely the group behind the worm called Raspberry Robin is just testing the waters — launching attacks against telecommunications companies and governments across Australia, Europe, and Latin America to see how far their malware can spread — for now.
Researchers at Trend Micro have been tracking Raspberry Robin since September and are warning the worm is notable for its 10 layers of obfuscation and its ability to deploy a fake payload to throw off detection efforts.
Raspberry Robin infected thousands of endpoints in October. Both October's endpoint attacks and the latest targeting of governments and the telecom sector relied on a malicious USB for initial infection.
"Our initial analysis of the malware, which compromised a number of organizations toward the end of September, showed that while the main malware routine contains both the real and fake payloads, it loads the fake payload once it detects sandboxing tools to evade security and analytics tools from detecting and studying the malware's real routine," Trend Micro reported, adding the team will continue to track the malware's activities.
About the Author(s)
You May Also Like
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
What's In Your Cloud?Nov 30, 2023
Everything You Need to Know About DNS AttacksNov 30, 2023