• Microsoft finds ‘Raspberry Robin’ worm in hundreds of Windows networks

    Home » Forums » Cyber Security Information and Advisories » Cyber Security for Business users » Microsoft finds ‘Raspberry Robin’ worm in hundreds of Windows networks

    • This topic has 5 replies, 4 voices, and was last updated 1 month ago.
    Author
    Topic
    #2457988

    https://www.bleepingcomputer.com/news/security/microsoft-finds-raspberry-robin-worm-in-hundreds-of-windows-networks/

    Microsoft says that a recently spotted Windows worm has been found on the networks of hundreds of organizations from various industry sectors.

    The malware, dubbed Raspberry Robin, spreads via infected USB devices, and it was first spotted in September 2021 by Red Canary intelligence analysts.

    Cybersecurity firm Sekoia also observed it using QNAP NAS devices as command and control servers (C2) servers in early November [PDF], while Microsoft said it found malicious artifacts linked to this worm created in 2019.

    Redmond’s findings align with those of the Red Canary’s Detection Engineering team, which also detected this worm on the networks of multiple customers, some of them in the technology and manufacturing sectors.

    Although Microsoft observed the malware connecting to addresses on the Tor network, the threat actors are yet to exploit the access they gained to their victims’ networks…

    Microsoft has tagged this campaign as high-risk, given that the attackers could download and deploy additional malware within the victims’ networks and escalate their privileges at any time…

    *0Patch fix in the works ?

    1 user thanked author for this post.
    Viewing 1 reply thread
    Author
    Replies
    • #2458014

      Chinese origin?

      * Is this a fact: "foreignpolicy.com/2022/04/25/the-real-threat-to-social-media-is-europe", Really? * get out of the poisonous Metaverse *
      • #2458126

        Security researchers who spotted Raspberry Robin in the wild are yet to attribute the malware to a threat group

        Please don’t speculate.

        cheers, Paul

        • #2458143

          this is not speculating Paul, see the Questionmark (?),
          I was hoping Askwoodysite could clarify some of  the dangers to worms like this.

          * Is this a fact: "foreignpolicy.com/2022/04/25/the-real-threat-to-social-media-is-europe", Really? * get out of the poisonous Metaverse *
    • #2458041

      *0Patch fix in the works ?

      Per the article you quoted above,

      Microsoft shared this info in a private threat intelligence advisory sent to Microsoft Defender for Endpoint subscribers…

      The above suggests that 0Patch will be hands off on this one, that it will be remediated by Microsoft by including a definition or engine update to Defender and by similar measures from other anti-crapware suite vendors.

       

      1 user thanked author for this post.
      • #2458134

        The above suggests that 0Patch will be hands off on this one, that it will be remediated by Microsoft by including a definition or engine update to Defender and by similar measures from other anti-crapware suite vendors.

        Not if will take months for Microsoft to fix.

    Viewing 1 reply thread
    Reply To: Microsoft finds ‘Raspberry Robin’ worm in hundreds of Windows networks

    You can use BBCodes to format your content.
    Your account can't use all available BBCodes, they will be stripped before saving.

    Your information: