Microsoft experts linked the Raspberry Robin malware to Evil Corp operation

Microsoft linked the recently discovered Raspberry Robin Windows malware to the notorious Evil Corp operation.

On July 26, 2022, Microsoft researchers discovered that the FakeUpdates malware was being distributed via Raspberry Robin malware.

Raspberry Robin is a Windows worm discovered by cybersecurity researchers from Red Canary, the malware propagates through removable USB devices.

The malicious code uses Windows Installer to reach out to QNAP-associated domains and download a malicious DLL. The malware uses TOR exit nodes as a backup C2 infrastructure.

The malware was first spotted in September 2021, the experts observed Raspberry Robin targeting organizations in the technology and manufacturing industries. Initial access is typically through infected removable drives, often USB devices.

The malware uses cmd.exe to read and execute a file stored on the infected external drive, it leverages msiexec.exe for external network communication to a rogue domain used as C2 to download and install a DLL library file.

Then msiexec.exe launches a legitimate Windows utility, fodhelper.exe, which in turn run rundll32.exe to execute a malicious command. Experts pointed out that processes launched by fodhelper.exe run with elevated administrative privileges without requiring a User Account Control prompt.

Now, Microsoft experts observed the threat actor DEV-0206 using the Raspberry Robin worm to deploy a downloader on networks that were also compromised by threat actors using Evil Corp TTPs.

“On July 26, 2022, Microsoft researchers discovered the FakeUpdates malware being delivered via existing Raspberry Robin infections,” reads the update provided by Microsoft.

“The DEV-0206-associated FakeUpdates activity on affected systems has since led to follow-on actions resembling DEV-0243 pre-ransomware behavior.”

DEV-0206 is an access broker tracked by Microsoft, which uses malvertising campaigns to compromise networks worldwide. Targets are tricked execute a fake browser update, or a software package, to download a ZIP file and double-click it. The ZIP package contains a JavaScript file, which once executed will start the infection process. 

“Once successfully executed, the JavaScript framework, also referred to SocGholish, acts as a loader for other malware campaigns that use access purchased from DEV-0206, most commonly Cobalt Strike payloads.” reads the analysis published by Microsoft.

In many cases, the infection process led to the deployment of custom Cobalt Strike loaders attributed to DEV-0243, which falls under activities tracked by the experts “EvilCorp,”  

Around November 2021, DEV-0243 started to deploy the LockBit 2.0 RaaS payload, experts believe that DEV-0243 threat actors used a RaaS payload by the “EvilCorp” activity group to avoid attribution.

The discovery made by Microsoft is very interesting because it is the first time that the researchers found evidence that Raspberry Robin operators leverage an access broker to compromise enterprise networks.

Follow me on Twitter: @securityaffairs and Faceboo