Raspberry Robin Exposed: Nearly 200 Unique C2 Domains Discovered

New Findings on Raspberry Robin Threat

A recent investigation has revealed approximately 200 unique command-and-control (C2) domains linked to a complex malware known as Raspberry Robin, also referred to as Roshtyak or Storm-0856. This malware acts as an initial access broker (IAB), facilitating access for various criminal organizations, many with ties to Russia, according to a report by Silent Push.

Path of Infection and Malicious Uses

Since its emergence in 2019, Raspberry Robin has evolved into a conduit for multiple malicious strains, including notorious names like Dridex and LockBit. A unique characteristic of its infection method is its utilization of compromised QNAP devices to deliver the malware payload. Moreover, new distribution techniques have surfaced, such as using archives sent via Discord to propagate malicious scripts. Experts suggest that Raspberry Robin is not just a standalone threat but may serve other actors by offering pay-per-install (PPI) services for subsequent malware deployment.

USB Propagation and Covert Operations

One of the most concerning aspects of Raspberry Robin is its USB-based propagation mechanism, which involves a compromised USB drive that masquerades as a folder to initiate installations. This method highlights the sophisticated tactics employed by threat actors to maximize the reach of malware.

Government Link and Network Analysis

U.S. government sources have indicated a possible connection between Raspberry Robin and the Russian state-backed threat actor known as Cadet Blizzard, showcasing a troubling intertwining of state-sponsored and criminal cyber activities. Silent Push, in collaboration with Team Cymru, uncovered a specific IP address acting as a data relay to coordinate commands across compromised devices, leading to the detection of over 180 unique C2 domains. This infrastructure uses techniques like fast flux, making it difficult for defenders to dismantle.

Short-lived Domains and Evasive Tactics

Interestingly, the identified domains tend to be quite short and frequently change, complicating efforts to track them down and mitigate the dangers. The primary top-level domains (TLDs) associated with Raspberry Robin include .wf, .pm, and .eu, with a reliance on a range of niche registrars for domain registration. These practices highlight the advanced operational security measures employed by the threat actors, asserting their intent to evade detection.

This multidimensional threat illustrated by Raspberry Robin underlines the necessity for enhanced cybersecurity measures and a collective effort to understand and combat the evolving landscape of cybercrime.