Raspberry Robin (22841966-6888-5ae5-8546-fd777cd66ca4)
Raspberry Robin is initial access malware first identified in September 2021, and active through early 2024. The malware is notable for spreading via infected USB devices containing a malicious LNK object that, on execution, retrieves remote hosted payloads for installation. Raspberry Robin has been widely used against various industries and geographies, and as a precursor to information stealer, ransomware, and other payloads such as SocGholish, Cobalt Strike, IcedID, and Bumblebee.[TrendMicro RaspberryRobin 2022][RedCanary RaspberryRobin 2022][HP RaspberryRobin 2024] The DLL componenet in the Raspberry Robin infection chain is also referred to as "Roshtyak."[Avast RaspberryRobin 2022] The name "Raspberry Robin" is used to refer to both the malware as well as the threat actor associated with its use, although the Raspberry Robin operators are also tracked as Storm-0856 by some vendors.[Microsoft RaspberryRobin 2022]
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Raspberry Robin (22841966-6888-5ae5-8546-fd777cd66ca4) | Tidal Software | FIN11 (ecdbd431-d62b-4b30-8663-b1ecb4304ec0) | Tidal Groups | 1 |