Raspberry Robin

Raspberry Robin is an activity cluster and long-running malware operation active since 2019. It is described as using a worm spread by infected external or USB drives, with infections beginning from a malicious shortcut file on the device. The shortcut launches msiexec.exe to retrieve a malicious DLL from remote command-and-control infrastructure, after which the malware establishes persistence via a scheduled task. Reporting also describes Raspberry Robin DLLs as having scrambled names in random ProgramData or AppData subfolders and being loaded with rundll32.exe or regsvr32.exe. Raspberry Robin has been associated with DLL loading activity and abuse of Windows Installer, and one reference notes tradecraft involving shell32.dll. Its command-and-control infrastructure has been described as using newly registered domains with only a few characters, including three-character patterns and uncommon two-letter TLDs such as .wf, .pm, and .re; one cited example is v0[.]cx. Another report tied roughly 200 unique domains to the operation and described Fast Flux behavior. The content also states that Raspberry Robin malware has exploited a Windows CLFS vulnerability for privilege escalation. Known alias in the provided content: raspberry_robin.