Raspberry Robin, Not a Juicy Raspberry You Love

Fast facts

1. 
   

   Raspberry Robin, previously disseminated through USB drives, now employs Discord for distribution.

   
   


2. 
   

   The utilization of Raspberry Robin has been observed dropping a variety of payloads, including ransomware and stealers, such as CLOP.

   
   


3. 
   

   Tools like RunDLL32 and Shell32.dll are abused for living off the land for proxy execution of malicious CPL files

   
   


4. 
   

   Raspberry Robin, also known as the QNAP worm, is attributed to a threat actor dubbed DEV-0856.

   
   

Security Research

Share This Story

In …

clop cpl discord distribution dll drives facts fast living off the land love malicious payloads proxy ransomware raspberry raspberry robin robin rundll32 stealers tools usb usb drives