Ankura CTIX FLASH Update - April 12, 2024

Ransomware/Malware Activity

Raspberry Robin Worm Now Spreads Through Windows Script Files (WSF)

Raspberry Robin is a Windows worm first introduced in 2021 and is known for establishing a malicious foothold in victim devices in order to deliver some of the most prevalent forms of malware including SocGholish, Cobalt Strike, and IcedID. Raspberry Robin has been known to initially infect victim computers through compromised USB devices, RAR files hosted on Discord, and ZIP files contained in malicious advertisements and downloaded via the web browser. Researchers have now identified a new infection method via Windows Script Files (.wsf) which are hosted on malicious domains and subdomains controlled by threat actors. The WSF file performs as a downloader and retrieves the main DLL payload from a compromised remote server using the curl command. Raspberry Robin is noted for its sophisticated obfuscation and anti-analysis techniques deployed to evade detection and