CIO News Hubb
Advertisement
  • Home
  • News
  • Operations CIO
  • Visionary CIO
  • IT Management
  • Information Security
  • Contact
No Result
View All Result
  • Home
  • News
  • Operations CIO
  • Visionary CIO
  • IT Management
  • Information Security
  • Contact
No Result
View All Result
CIO News Hubb
No Result
View All Result
Home Information Security

Raspberry Robin Worm Strikes Again, Targeting Telecom and Government Systems

admin by admin
December 21, 2022
in Information Security


Dec 21, 2022Ravie Lakshmanan

The Raspberry Robin worm has been used in attacks against telecommunications and government office systems across Latin America, Australia, and Europe since at least September 2022.

“The main payload itself is packed with more than 10 layers for obfuscation and is capable of delivering a fake payload once it detects sandboxing and security analytics tools,” Trend Micro researcher Christopher So said in a technical analysis published Tuesday.

A majority of the infections have been detected in Argentina, followed by Australia, Mexico, Croatia, Italy, Brazil, France, India, and Colombia.

Raspberry Robin, attributed to an activity cluster tracked by Microsoft as DEV-0856, is being increasingly leveraged by multiple threat actors as an initial access mechanism to deliver payloads such as LockBit and Clop ransomware.

CyberSecurity

The malware is known for relying on infected USB drives as a distribution vector to download a rogue MSI installer file that deploys the main payload responsible for facilitating post-exploitation.

Further analysis of Raspberry Robin reveals the use of heavy obfuscation to prevent analysis, with the malware “composed of two payloads embedded in a payload loader packed six times.”

The payload loader, for its part, is orchestrated to load the decoy payload, an adware dubbed BrowserAssistant, to throw off detection efforts.

Raspberry Robin

Should no sandboxing and analysis be observed, the legitimate payload is installed and proceeds to connect to a hard-coded .onion address using a custom TOR client embedded within it to await further commands.

The TOR client process masquerades as legitimate Windows processes like dllhost.exe, regsvr32.exe, and rundll32.exe, once again underscoring the considerable efforts made by the threat actor to fly under the radar.

What’s more, the malware’s real routine is run in Session 0, a specialized Windows session reserved for services and other non-interactive user applications to mitigate security risks such as shatter attacks.

Trend Micro said it found similarities in a privilege escalation and an anti-debugging technique used by Raspberry Robin and LockBit ransomware, hinting at a potential connection between the two criminal actors.

“The group behind Raspberry Robin is the maker of some of the tools LockBit is also using,” the company theorized, adding it alternatively “availed of the services of the affiliate responsible for the techniques used by LockBit.”

That having said, the intrusions appear to be a reconnaissance operation, as no data is returned from the TOR domain, suggesting that the group behind the malware is “testing the waters to see how far its deployments can spread.”

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.





Source link

Tags: computer securitycyber attackscyber newscyber security newscyber security news todaycyber security updatescyber updatesdata breachhacker newshacking newshow to hackinformation securitynetwork securityransomware malwaresoftware vulnerabilitythe hacker news
Previous Post

Merry Patching Christmas

Next Post

Ingredientsinleadershipofbods ~ Future of CIO

Related Posts

Information Security

New Russian-Backed Gamaredon’s Spyware Variants Targeting Ukrainian Authorities

by admin
February 2, 2023
Information Security

AWS achieves ISO 20000-1:2018 certification for 109 services

by admin
February 2, 2023
Information Security

Everything you need to know

by admin
February 2, 2023
Information Security

Researchers Uncover New Bugs in Popular ImageMagick Image Processing Utility

by admin
February 1, 2023
Information Security

How to set up ongoing replication from your third-party secrets manager to AWS Secrets Manager

by admin
February 1, 2023
Next Post

Ingredientsinleadershipofbods ~ Future of CIO

Recommended

Initiatetogoapproach

February 2, 2023

New Russian-Backed Gamaredon’s Spyware Variants Targeting Ukrainian Authorities

February 2, 2023

AWS achieves ISO 20000-1:2018 certification for 109 services

February 2, 2023

Everything you need to know

February 2, 2023

Influentialleadership ~ Future of CIO

February 1, 2023

Researchers Uncover New Bugs in Popular ImageMagick Image Processing Utility

February 1, 2023

© 2022 CIO News Hubb All rights reserved.

Use of these names, logos, and brands does not imply endorsement unless specified. By using this site, you agree to the Privacy Policy and Terms & Conditions.

Navigate Site

  • Home
  • News
  • Operations CIO
  • Visionary CIO
  • IT Management
  • Information Security
  • Contact

Newsletter Sign Up

No Result
View All Result
  • Home
  • News
  • Operations CIO
  • Visionary CIO
  • IT Management
  • Information Security
  • Contact

© 2022 CIO News Hubb All rights reserved.