Raspberry Robin Worm Targets Telcos & Governments

With 10 layers of obfuscation and fake payloads, the Raspberry Robin worm is nesting its way deep into organizations.

Dark Reading Staff, Dark Reading

December 20, 2022

1 Min Read
north american robin in a tree with red berries
Source: Design Pics via Alamy Stock Photo

It's likely the group behind the worm called Raspberry Robin is just testing the waters — launching attacks against telecommunications companies and governments across Australia, Europe, and Latin America to see how far their malware can spread — for now.

Researchers at Trend Micro have been tracking Raspberry Robin since September and are warning the worm is notable for its 10 layers of obfuscation and its ability to deploy a fake payload to throw off detection efforts.

Raspberry Robin infected thousands of endpoints in October. Both October's endpoint attacks and the latest targeting of governments and the telecom sector relied on a malicious USB for initial infection.

"Our initial analysis of the malware, which compromised a number of organizations toward the end of September, showed that while the main malware routine contains both the real and fake payloads, it loads the fake payload once it detects sandboxing tools to evade security and analytics tools from detecting and studying the malware's real routine," Trend Micro reported, adding the team will continue to track the malware's activities.

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights