Unmasking Raspberry Robin: The Evolving Malware Powering Russian Cyber Threats

Title: New Threat from Raspberry Robin: Insights into a Complex Malware Network

Date: March 25, 2025

In a startling revelation, cybersecurity researchers have identified nearly 200 unique command-and-control (C2) domains linked to a pervasive malware threat known as Raspberry Robin. This malware, also referred to as Roshtyak or Storm-0856, has evolved dramatically since it first appeared in 2019, morphing into a vital toolkit for numerous criminal groups, many with ties to Russia.

According to a report from Silent Push shared with The Hacker News, Raspberry Robin functions as an "initial access broker," facilitating the infiltration of systems for other malware strains including Dridex, LockBit, and BumbleBee. Notably, the malware exploits compromised QNAP devices to deliver its payload, earning the nickname "QNAP worm."

Recent investigations have uncovered sophisticated distribution methods employed by Raspberry Robin. Attack chains now utilize archives and Windows Script Files transmitted via Discord, alongside acquiring flaws for local privilege escalation before they are made public. Furthermore, indications suggest that Raspberry Robin may operate as a pay-per-install botnet for other malicious actors.

The malware’s unique propagation method includes USB-based infections through compromised USB drives containing hidden malware files. The U.S. government’s cybersecurity officials have linked the malware to Russian state-sponsored threats, notably the actor known as Cadet Blizzard.

Silent Push, alongside Team Cymru, detected a singular IP acting as a command relay for these C2 domains, which utilized Tor relays, complicating the overall combat against the malware. The ongoing investigation reveals fast-flux techniques employed to rotate C2 domains rapidly, making it particularly challenging for security teams to dismantle this intricate system.

As cyber threats continue to evolve, the case of Raspberry Robin serves as a stark reminder of the complex landscape businesses and individuals must navigate to safeguard their digital environments.