CIO News Hubb
Advertisement
  • Home
  • News
  • Operations CIO
  • Visionary CIO
  • IT Management
  • Information Security
  • Contact
No Result
View All Result
  • Home
  • News
  • Operations CIO
  • Visionary CIO
  • IT Management
  • Information Security
  • Contact
No Result
View All Result
CIO News Hubb
No Result
View All Result
Home Information Security

New Analysis Reveals Raspberry Robin Can be Repurposed by Other Threat Actors

admin by admin
January 11, 2023
in Information Security


Jan 11, 2023Ravie LakshmananCyber Threat / Malware

A new analysis of Raspberry Robin’s attack infrastructure has revealed that it’s possible for other threat actors to repurpose the infections for their own malicious activities, making it an even more potent threat.

Raspberry Robin (aka QNAP worm), attributed to a threat actor dubbed DEV-0856, is malware that has increasingly come under the radar for being used in attacks aimed at finance, government, insurance, and telecom entities.

Given its use multiple threat actors to drop a wide range of payloads such as SocGholish, Bumblebee, TrueBot, IcedID, and LockBit ransomware, it’s suspected to be a pay-per-install (PPI) botnet capable of serving next-stage payloads.

Raspberry Robin, notably, employs infected USB drives as a propagation mechanism and leverages breached QNAP network-attached storage (NAS) devices as first-level command-and-control (C2).

Cybersecurity firm SEKOIA said it was able to identify at least eight virtual private servers (VPSs) hosted on Linode that function as a second C2 layer that likely act as forward proxies to the next as-yet-unknown tier.

Raspberry Robin
Raspberry Robin

“Each compromised QNAP seems to act as a validator and forwarder,” the France-based company said. “If the received request is valid, it is redirected to an upper level of infrastructure.”

The attack chain thus unfolds as follows: When a user inserts the USB drive and launches a Windows shortcut (.LNK) file, the msiexec utility is launched, which, in turn, downloads the main obfuscated Raspberry Robin payload from the QNAP instance.

This reliance on msiexec to send out HTTP requests to fetch the malware makes it possible to hijack such requests to download another rogue MSI payload either by DNS hijacking attacks or purchasing previously known domains after their expiration.

One such domain is tiua[.]uk, which was registered in the early days of the campaign in late July 2021 and used as a C2 between September 22, 2021, and November 30, 2022, when it was suspended by the .UK registry.

“By pointing this domain to our sinkhole, we were able to obtain telemetry from one of the first domains used by Raspberry Robin operators,” the company said, adding it observed several victims, indicating “it was still possible to repurpose a Raspberry Robin domain for malicious activities.”

The exact origins of how the first wave of Raspberry Robin USB infections took place remain currently unknown, although it’s suspected that it may have been achieved by relying on other malware to disseminate the worm.

Raspberry Robin

This hypothesis is evidenced by the presence of a .NET spreader module that’s said to be responsible for distributing Raspberry Robin .LNK files from infected hosts to USB drives. These .LNK files subsequently compromise other machines via the aforementioned method.

The development comes days after Google’s Mandiant disclosed that the Russia-linked Turla group reused expired domains associated with ANDROMEDA malware to deliver reconnaissance and backdoor tools to targets compromised by the latter in Ukraine.

“Botnets serve multiple purposes and can be reused and/or remodeled by their operators or even hijacked by other groups over time,” the researcher said.

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.





Source link

Tags: computer securitycyber attackscyber newscyber security newscyber security news todaycyber security updatescyber updatesdata breachhacker newshacking newshow to hackinformation securitynetwork securityransomware malwaresoftware vulnerabilitythe hacker news
Previous Post

Differently than Large Enterprises and Tech Companies

Next Post

Illuminateleadership

Related Posts

Information Security

New Russian-Backed Gamaredon’s Spyware Variants Targeting Ukrainian Authorities

by admin
February 2, 2023
Information Security

AWS achieves ISO 20000-1:2018 certification for 109 services

by admin
February 2, 2023
Information Security

Everything you need to know

by admin
February 2, 2023
Information Security

Researchers Uncover New Bugs in Popular ImageMagick Image Processing Utility

by admin
February 1, 2023
Information Security

How to set up ongoing replication from your third-party secrets manager to AWS Secrets Manager

by admin
February 1, 2023
Next Post

Illuminateleadership

Recommended

Initiatetogoapproach

February 2, 2023

New Russian-Backed Gamaredon’s Spyware Variants Targeting Ukrainian Authorities

February 2, 2023

AWS achieves ISO 20000-1:2018 certification for 109 services

February 2, 2023

Everything you need to know

February 2, 2023

Influentialleadership ~ Future of CIO

February 1, 2023

Researchers Uncover New Bugs in Popular ImageMagick Image Processing Utility

February 1, 2023

© 2022 CIO News Hubb All rights reserved.

Use of these names, logos, and brands does not imply endorsement unless specified. By using this site, you agree to the Privacy Policy and Terms & Conditions.

Navigate Site

  • Home
  • News
  • Operations CIO
  • Visionary CIO
  • IT Management
  • Information Security
  • Contact

Newsletter Sign Up

No Result
View All Result
  • Home
  • News
  • Operations CIO
  • Visionary CIO
  • IT Management
  • Information Security
  • Contact

© 2022 CIO News Hubb All rights reserved.