Home
Internet
Internet News
Microsoft Finds 'Raspberry Robin' Worm In Windows Networks: All You Need To Know

Microsoft Finds 'Raspberry Robin' Worm In Windows Networks: All You Need To Know

Researchers determined that the worm spreads to new devices through a malicious link file after studying an infected USB drive.

By Diksha Rani | Updated: 6 July 2022 17:35 IST

Microsoft Finds 'Raspberry Robin' Worm In Windows Networks: All You Need To Know

The malware is called "Raspberry Robin" and spreads through USB devices.

Microsoft has spotted a dangerous Windows worm on networks of hundreds of organisations in various industries, as per a report that cites a private threat intelligence advisory sent to companies by the Redmond giant. The malware is called "Raspberry Robin" and spreads through USB devices, the report further said.

As per the report by Bleeping Computer, Microsoft's threat intelligence advisory that was shared with its Microsoft Defender for Endpoint subscribers says the Raspberry Robin worm has been spotted connecting to various addresses on the Tor network, but the threat actors have yet to exploit this access.

The group responsible for releasing the malware is currently unknown and the company is actively monitoring the networks. "Raspberry Robin" was first discovered in September last year by Red Canary researchers who spotted a "cluster of malicious activity". The researchers determined that the worm spreads to new devices through a malicious link file after studying an infected USB drive that contained a .LNK file.

As per the researchers, when the victim connects the infected USB drive, the worm starts a new process via the command prompt and runs the file on the compromised computer. The malware utilises Microsoft Standard Installer to connect to its command and control (C2) server (msiexec.exe) after which more malicious files are downloaded on the devices.

The experts at cybersecurity company Sekoia also noticed it while using QNAP NAS devices late last year.

Microsoft has categorised the present threat as "high-risk," saying that the attackers could infect entire networks if they wish to.

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.