New Analysis Reveals Raspberry Robin Can be Repurposed by Other Threat Actors

Jan 11, 2023Ravie LakshmananCyber Threat / Malware

A new analysis of Raspberry Robin’s attack infrastructure has
revealed^[1]
that it’s possible for other threat actors to repurpose the
infections for their own malicious activities, making it an even
more potent threat.

Raspberry Robin (aka QNAP worm), attributed to a threat actor
dubbed DEV-0856, is malware that has increasingly^[2]
come under the radar^[3]
for being used in attacks aimed at finance, government, insurance,
and telecom entities.

Given its use multiple threat actors to drop a wide range of
payloads such as SocGholish^[4], Bumblebee^[5], TrueBot^[6], IcedID^[7], and LockBit^[8]
ransomware, it’s suspected to be a pay-per-install (PPI) botnet
capable of serving next-stage payloads.

Raspberry Robin, notably, employs infected USB drives as a
propagation mechanism and leverages breached QNAP network-attached
storage (NAS) devices as first-level command-and-control (C2).

Cybersecurity firm SEKOIA said it was able to identify at least
eight virtual private servers (VPSs) hosted on Linode that function
as a second C2 layer that likely act as forward proxies to the next
as-yet-unknown tier.

“Each compromised QNAP seems to act as a validator and
forwarder,” the France-based company said. “If the received request
is valid, it is redirected to an upper level of
infrastructure.”

The attack chain thus unfolds as follows: When a user inserts
the USB drive and launches a Windows shortcut (.LNK) file, the
msiexec utility^[9]
is launched, which, in turn, downloads the main obfuscated Raspberry Robin
payload^[10] from the QNAP
instance.

This reliance on msiexec to send out HTTP requests to fetch the
malware makes it possible to hijack such requests to download
another rogue MSI payload either by DNS hijacking attacks or
purchasing previously known domains after their expiration.

One such domain is tiua[.]uk, which was registered in the early
days of the campaign in late July 2021 and used as a C2 between
September 22, 2021, and November 30, 2022, when it was suspended by
the .UK registry.

“By pointing this domain to our sinkhole, we were able to obtain
telemetry from one of the first domains used by Raspberry Robin
operators,” the company said, adding it observed several victims,
indicating “it was still possible to repurpose a Raspberry Robin
domain for malicious activities.”

The exact origins of how the first wave of Raspberry Robin USB
infections took place remain currently unknown, although it’s
suspected that it may have been achieved by relying on other
malware to disseminate the worm.

This hypothesis is evidenced^[11] by the presence of a
.NET spreader module that’s said to be responsible for distributing
Raspberry Robin .LNK files from infected hosts to USB drives. These
.LNK files subsequently compromise other machines via the
aforementioned method.

The development comes days after Google’s Mandiant disclosed^[12] that the Russia-linked
Turla group reused expired domains associated with ANDROMEDA
malware to deliver reconnaissance and backdoor tools to targets
compromised by the latter in Ukraine.

“Botnets serve multiple purposes and can be reused and/or
remodeled by their operators or even hijacked by other groups over
time,” the researcher said.