Raspberry Robin Keeps Riding the Wave of Endless 1-Days

Key Findings

• Two new 1-day LPE exploits were used by the Raspberry Robin worm before they were publicly disclosed, which means that Raspberry Robin has access to an exploit seller or its authors develop the exploits themselves in a short period of time.


• Raspberry Robin is continually updated with new features and evasions to be even stealthier than before.


• Raspberry Robin slightly changed its communication method and lateral movement to avoid being caught by behavioral signatures implemented based on its …

access authors exploit exploits features findings key lpe malware analysis new features period raspberry raspberry robin raspberry robin worm robin worm