Threat intelligence / Malware

Raspberry Robin

[Raspberry Robin](https://attack.mitre.org/software/S1130) is initial access malware first identified in September 2021, and active through early 2024. The malware is notable for spreading via infected USB devices containing a malicious LNK object that, on execution, retrieves remote hosted payloads for installation. [Raspberry Robin](https://attack.mitre.org/software/S1130) has been widely used against various industries and geographies, and as a precursor to information stealer, ransomware, and other payloads such as [SocGholish](https://attack.mitre.org/software/S1124), [Cobalt Strike](https://attack.mitre.org/software/S0154), [IcedID](https://attack.mitre.org/software/S0483), and [Bumblebee](https://attack.mitre.org/software/S1039).(Citation: TrendMicro RaspberryRobin 2022)(Citation: RedCanary RaspberryRobin 2022)(Citation: HP RaspberryRobin 2024) The DLL componenet in the [Raspberry Robin](https://attack.mitre.org/software/S1130) infection chain is also referred to as "Roshtyak."(Citation: Avast RaspberryRobin 2022) The name "Raspberry Robin" is used to refer to both the malware as well as the threat actor associated with its use, although the Raspberry Robin operators are also tracked as Storm-0856 by some vendors.(Citation: Microsoft RaspberryRobin 2022)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Raspberry Robin](https://attack.mitre.org/software/S1130) is initial access malware first identified in September 2021, and active through early 2024. The malware is notable for spreading via infected USB devices containing a malicious LNK object that, on execution, retrieves remote hosted payloads for installation. [Raspberry Robin](https://attack.mitre.org/software/S1130) has been widely used against various industries and geographies, and as a precursor to information stealer, ransomware, and other payloads such as [SocGholish](https://attack.mitre.org/software/S1124), [Cobalt Strike](https://attack.mitre.org/software/S0154), [IcedID](https://attack.mitre.org/software/S0483), and [Bumblebee](https://attack.mitre.org/software/S1039).(Citation: TrendMicro RaspberryRobin 2022)(Citation: RedCanary RaspberryRobin 2022)(Citation: HP RaspberryRobin 2024) The DLL componenet in the [Raspberry Robin](https://attack.mitre.org/software/S1130) infection chain is also referred to as "Roshtyak."(Citation: Avast RaspberryRobin 2022) The name "Raspberry Robin" is used to refer to both the malware as well as the threat actor associated with its use, although the Raspberry Robin operators are also tracked as Storm-0856 by some vendors.(Citation: Microsoft RaspberryRobin 2022)

Labels

malware

41 recorded

Relationships

uses

to Abuse Elevation Control Mechanism

Technique

uses

to Application Layer Protocol

Technique

uses

to Bypass User Account Control

Technique

uses

to Clear Persistence

Technique

uses

to Command and Scripting Interpreter

Technique

uses

to Component Object Model

Technique

uses

to Debugger Evasion

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Disable or Modify Tools

Technique

uses

to DLL

Technique

uses

Technique

uses

to Execution Guardrails

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Hijack Execution Flow

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Inter-Process Communication

Technique

uses

to Malvertising

Technique

uses

to Masquerade File Type

Technique

uses

to Masquerade Task or Service

Technique

uses

Technique

uses

to Non-Standard Port

Technique

uses

to Obfuscated Files or Information

Technique

uses

Technique

uses

to Process Discovery

Technique

uses

to Process Hollowing

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

Technique

uses

to Replication Through Removable Media

Technique

uses

Technique

uses

to Security Software Discovery

Technique

uses

to Software Packing

Technique

uses

to System Checks

Technique

uses

to System Information Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to User Execution

Technique

uses

to Virtualization/Sandbox Evasion

Technique

uses

to Web Protocols

Technique

uses

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

6 external

References

mitre-attack

S1130

TrendMicro RaspberryRobin 2022

https://www.trendmicro.com/en_us/research/22/l/raspberry-robin-malware-targets-telecom-governments.html

Avast RaspberryRobin 2022

https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/

RedCanary RaspberryRobin 2022

https://redcanary.com/blog/threat-intelligence/raspberry-robin/

Microsoft RaspberryRobin 2022

https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/

HP RaspberryRobin 2024

https://threatresearch.ext.hp.com/raspberry-robin-now-spreading-through-windows-script-files/