{"id":6452,"date":"2022-09-04T22:42:54","date_gmt":"2022-09-04T22:42:54","guid":{"rendered":"https:\/\/sajinshivdas.com\/security\/?p=6452"},"modified":"2023-03-27T08:44:10","modified_gmt":"2023-03-27T08:44:10","slug":"russian-criminal-organization-linked-to-raspberry-robin-malware","status":"publish","type":"post","link":"https:\/\/sajinshivdas.com\/cybersecurity\/russian-criminal-organization-linked-to-raspberry-robin-malware\/","title":{"rendered":"Russian Criminal Organization Linked to Raspberry Robin Malware"},"content":{"rendered":"[vc_row type=&#8221;in_container&#8221; full_screen_row_position=&#8221;middle&#8221; column_margin=&#8221;default&#8221; column_direction=&#8221;default&#8221; column_direction_tablet=&#8221;default&#8221; column_direction_phone=&#8221;default&#8221; scene_position=&#8221;center&#8221; text_color=&#8221;dark&#8221; text_align=&#8221;left&#8221; row_border_radius=&#8221;none&#8221; row_border_radius_applies=&#8221;bg&#8221; overflow=&#8221;visible&#8221; overlay_strength=&#8221;0.3&#8243; gradient_direction=&#8221;left_to_right&#8221; shape_divider_position=&#8221;bottom&#8221; bg_image_animation=&#8221;none&#8221;][vc_column column_padding=&#8221;no-extra-padding&#8221; column_padding_tablet=&#8221;inherit&#8221; column_padding_phone=&#8221;inherit&#8221; column_padding_position=&#8221;all&#8221; column_element_direction_desktop=&#8221;default&#8221; column_element_spacing=&#8221;default&#8221; desktop_text_alignment=&#8221;default&#8221; tablet_text_alignment=&#8221;default&#8221; phone_text_alignment=&#8221;default&#8221; background_color_opacity=&#8221;1&#8243; background_hover_color_opacity=&#8221;1&#8243; column_backdrop_filter=&#8221;none&#8221; column_shadow=&#8221;none&#8221; column_border_radius=&#8221;none&#8221; column_link_target=&#8221;_self&#8221; column_position=&#8221;default&#8221; gradient_direction=&#8221;left_to_right&#8221; overlay_strength=&#8221;0.3&#8243; width=&#8221;1\/1&#8243; tablet_width_inherit=&#8221;default&#8221; animation_type=&#8221;default&#8221; bg_image_animation=&#8221;none&#8221; border_type=&#8221;simple&#8221; column_border_width=&#8221;none&#8221; column_border_style=&#8221;solid&#8221;][nectar_single_testimonial testimonial_style=&#8221;small_modern&#8221; color=&#8221;Default&#8221; quote=&#8221;Evidence links the USB-based worm to Dridex and the Russian cybercriminal entity Evil Corp.&#8221;][vc_row_inner column_margin=&#8221;default&#8221; column_direction=&#8221;default&#8221; column_direction_tablet=&#8221;default&#8221; column_direction_phone=&#8221;default&#8221; text_align=&#8221;left&#8221; row_position=&#8221;default&#8221; row_position_tablet=&#8221;inherit&#8221; row_position_phone=&#8221;inherit&#8221; overflow=&#8221;visible&#8221; pointer_events=&#8221;all&#8221;][vc_column_inner column_padding=&#8221;no-extra-padding&#8221; column_padding_tablet=&#8221;inherit&#8221; column_padding_phone=&#8221;inherit&#8221; column_padding_position=&#8221;all&#8221; column_element_direction_desktop=&#8221;default&#8221; column_element_spacing=&#8221;default&#8221; desktop_text_alignment=&#8221;default&#8221; tablet_text_alignment=&#8221;default&#8221; phone_text_alignment=&#8221;default&#8221; background_color_opacity=&#8221;1&#8243; background_hover_color_opacity=&#8221;1&#8243; column_backdrop_filter=&#8221;none&#8221; column_shadow=&#8221;none&#8221; column_border_radius=&#8221;none&#8221; column_link_target=&#8221;_self&#8221; overflow=&#8221;visible&#8221; gradient_direction=&#8221;left_to_right&#8221; overlay_strength=&#8221;0.3&#8243; width=&#8221;1\/1&#8243; tablet_width_inherit=&#8221;default&#8221; animation_type=&#8221;default&#8221; bg_image_animation=&#8221;none&#8221; border_type=&#8221;simple&#8221; column_border_width=&#8221;none&#8221; column_border_style=&#8221;solid&#8221;][vc_column_text]\n<p lang=\"en-US\" style=\"margin: 0in; font-family: Calibri; font-size: 11.0pt;\">Similarities between the Raspberry Robin USB-based worm and the Dridex malware loader suggest that it originated with the banned Russian ransomware gang Evil Corp.<\/p>\n<p lang=\"en-US\" style=\"margin: 0in; font-family: Calibri; font-size: 11.0pt;\">IBM Security reverse-engineered two DLLs delivered by Raspberry Robin and compared them to the Dridex malware loader, a tool previously associated to Evil Corp. (the US Department of the <a href=\"https:\/\/home.treasury.gov\/news\/press-releases\/sm845\">Treasury sanctioned the Russia-based Evil Corp<\/a>. for generating Dridex in 2019).They discovered that the decoding algorithms were very similar to one another, with anti-analysis code present in the intermediate loader code and the use of random strings in the portable executables.<\/p>\n<p lang=\"en-US\" style=\"margin: 0in; font-family: Calibri; font-size: 11.0pt;\">Kevin Henson, a malware reverse engineer at IBM Security, said that &#8220;the <a href=\"https:\/\/securityintelligence.com\/posts\/raspberry-robin-worm-dridex-malware\/\">result<\/a>s suggest that they are comparable in structure and behavior.&#8221; Attacks by &#8220;Evil Corp&#8221; are &#8220;likely being executed utilizing Raspberry Robin infrastructure.<\/p>\n[\/vc_column_text][divider line_type=&#8221;No Line&#8221; custom_height=&#8221;10&#8243;][divider line_type=&#8221;No Line&#8221; custom_height=&#8221;10&#8243;][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=&#8221;default&#8221; column_direction=&#8221;default&#8221; column_direction_tablet=&#8221;default&#8221; column_direction_phone=&#8221;default&#8221; text_align=&#8221;left&#8221; row_position=&#8221;default&#8221; row_position_tablet=&#8221;inherit&#8221; row_position_phone=&#8221;inherit&#8221; overflow=&#8221;visible&#8221; pointer_events=&#8221;all&#8221;][vc_column_inner column_padding=&#8221;no-extra-padding&#8221; column_padding_tablet=&#8221;inherit&#8221; column_padding_phone=&#8221;inherit&#8221; column_padding_position=&#8221;all&#8221; column_element_direction_desktop=&#8221;default&#8221; column_element_spacing=&#8221;default&#8221; desktop_text_alignment=&#8221;default&#8221; tablet_text_alignment=&#8221;default&#8221; phone_text_alignment=&#8221;default&#8221; background_color_opacity=&#8221;1&#8243; background_hover_color_opacity=&#8221;1&#8243; column_backdrop_filter=&#8221;none&#8221; column_shadow=&#8221;none&#8221; column_border_radius=&#8221;none&#8221; column_link_target=&#8221;_self&#8221; overflow=&#8221;visible&#8221; gradient_direction=&#8221;left_to_right&#8221; overlay_strength=&#8221;0.3&#8243; width=&#8221;1\/1&#8243; tablet_width_inherit=&#8221;default&#8221; animation_type=&#8221;default&#8221; bg_image_animation=&#8221;none&#8221; border_type=&#8221;simple&#8221; column_border_width=&#8221;none&#8221; column_border_style=&#8221;solid&#8221;][vc_column_text]\n<p lang=\"en-US\" style=\"margin: 0in; font-family: Calibri; font-size: 18.0pt;\"><span style=\"font-weight: bold;\">Fledgling Raspberry Robin Takes Off<\/span><\/p>\n<p lang=\"en-US\" style=\"margin: 0in; font-family: Calibri; font-size: 11.0pt;\">In May, <a href=\"https:\/\/redcanary.com\/blog\/raspberry-robin\/\">Raspberry Robin was initially studied and given a name by security firm Red Canary<\/a>. Others in the scientific community quickly caught wind of it, with IBM Security among them.<\/p>\n<p lang=\"en-US\" style=\"margin: 0in; font-family: Calibri; font-size: 11.0pt;\">The worm travels swiftly across corporate networks by infecting shared USB drives. 17% of IBM Security&#8217;s managed clients in targeted industries saw infection attempts this summer, despite the fact that Raspberry Robin depends on social engineering techniques to convince victims to put in an infected USB device.<\/p>\n<p lang=\"en-US\" style=\"margin: 0in; font-family: Calibri; font-size: 11.0pt;\">Researchers were first baffled by the malware because it seemed to do nothing malicious once it had infected a device; instead, it just went into hibernation. In July, though, researchers from IBM and Microsoft found that affected PCs had began installing FakeUpdates malware, a common precursor to Evil Corp&#8217;s ransomware.<\/p>\n<p lang=\"en-US\" style=\"margin: 0in; font-family: Calibri; font-size: 11.0pt;\">FakeUpdates, also known as SocGhoulish, is malware that <a href=\"https:\/\/www.microsoft.com\/en-us\/wdsi\/threats\/malware-encyclopedia-description?Name=Trojan:JS\/FakeUpdate.C\">seems to be an important software update<\/a> but instead installs malicious software, such as ransomware or the widely used attack programs Cobalt Strike and Mimikatz, on the victim&#8217;s machine.<\/p>\n<p lang=\"en-US\" style=\"margin: 0in; font-family: Calibri; font-size: 11.0pt;\">Microsoft stated back then that FakeUpdates is commonly blamed on an access broker the company monitors under the identifier DEV-206. If <a href=\"https:\/\/www.microsoft.com\/security\/blog\/2022\/05\/09\/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself\/#DEV-0206-DEV-0243\">the speculation that Evil Corp is spreading FakeUpdates via pre-existin<\/a>g Raspberry Robin infections is correct, then it is likely that the access broker is working closely with Evil Corp.<\/p>\n<p lang=\"en-US\" style=\"margin: 0in; font-family: Calibri; font-size: 11.0pt;\">A look back at the data shows that the first sign of the Raspberry Robins&#8217; antics occurred in September of 2021. Industries in the manufacturing, technology, oil and gas, and transportation sectors are common targets of the malware.<\/p>\n[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row]\n","protected":false},"excerpt":{"rendered":"<p>[vc_row type=&#8221;in_container&#8221; full_screen_row_position=&#8221;middle&#8221; column_margin=&#8221;default&#8221; column_direction=&#8221;default&#8221; column_direction_tablet=&#8221;default&#8221; column_direction_phone=&#8221;default&#8221; scene_position=&#8221;center&#8221; text_color=&#8221;dark&#8221; text_align=&#8221;left&#8221; row_border_radius=&#8221;none&#8221; row_border_radius_applies=&#8221;bg&#8221; overflow=&#8221;visible&#8221; overlay_strength=&#8221;0.3&#8243; gradient_direction=&#8221;left_to_right&#8221; shape_divider_position=&#8221;bottom&#8221; bg_image_animation=&#8221;none&#8221;][vc_column column_padding=&#8221;no-extra-padding&#8221; column_padding_tablet=&#8221;inherit&#8221; column_padding_phone=&#8221;inherit&#8221; column_padding_position=&#8221;all&#8221; column_element_direction_desktop=&#8221;default&#8221; column_element_spacing=&#8221;default&#8221; desktop_text_alignment=&#8221;default&#8221; tablet_text_alignment=&#8221;default&#8221;&#8230;<\/p>\n","protected":false},"author":1,"featured_media":6454,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[33,6],"tags":[57,52],"class_list":{"0":"post-6452","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-malware","8":"category-vulnerability-assessment","9":"tag-malware","10":"tag-vulnerabilities"},"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Russian Criminal Organization Linked to Raspberry Robin Malware - Sajin Shivdas | Cybersecurity<\/title>\n<meta name=\"description\" content=\"Similarities between the Raspberry Robin USB-based worm and the Dridex malware loader suggest that it originated with the banned Russian ransomware gang\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/sajinshivdas.com\/cybersecurity\/russian-criminal-organization-linked-to-raspberry-robin-malware\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Russian Criminal Organization Linked to Raspberry Robin Malware - Sajin Shivdas | Cybersecurity\" \/>\n<meta property=\"og:description\" content=\"Similarities between the Raspberry Robin USB-based worm and the Dridex malware loader suggest that it originated with the banned Russian ransomware gang\" \/>\n<meta property=\"og:url\" content=\"https:\/\/sajinshivdas.com\/cybersecurity\/russian-criminal-organization-linked-to-raspberry-robin-malware\/\" \/>\n<meta property=\"og:site_name\" content=\"Sajin Shivdas | Cybersecurity\" \/>\n<meta property=\"article:published_time\" content=\"2022-09-04T22:42:54+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-03-27T08:44:10+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/sajinshivdas.com\/cybersecurity\/wp-content\/uploads\/2023\/01\/closeup-gray-orange-robin-bird-sitting-barbed-wire-blurred-background.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1500\" \/>\n\t<meta property=\"og:image:height\" content=\"973\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Sajin Shivdas\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Sajin Shivdas\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":[\"Article\",\"BlogPosting\"],\"@id\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/russian-criminal-organization-linked-to-raspberry-robin-malware\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/russian-criminal-organization-linked-to-raspberry-robin-malware\\\/\"},\"author\":{\"name\":\"Sajin Shivdas\",\"@id\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/#\\\/schema\\\/person\\\/af1d121cbedd3ce64369f21a359ff2e6\"},\"headline\":\"Russian Criminal Organization Linked to Raspberry Robin Malware\",\"datePublished\":\"2022-09-04T22:42:54+00:00\",\"dateModified\":\"2023-03-27T08:44:10+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/russian-criminal-organization-linked-to-raspberry-robin-malware\\\/\"},\"wordCount\":871,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/#\\\/schema\\\/person\\\/af1d121cbedd3ce64369f21a359ff2e6\"},\"image\":{\"@id\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/russian-criminal-organization-linked-to-raspberry-robin-malware\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/wp-content\\\/uploads\\\/2023\\\/01\\\/closeup-gray-orange-robin-bird-sitting-barbed-wire-blurred-background.jpg\",\"keywords\":[\"Malware\",\"Vulnerabilities\"],\"articleSection\":[\"Malware\",\"Vulnerability\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/russian-criminal-organization-linked-to-raspberry-robin-malware\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/russian-criminal-organization-linked-to-raspberry-robin-malware\\\/\",\"url\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/russian-criminal-organization-linked-to-raspberry-robin-malware\\\/\",\"name\":\"Russian Criminal Organization Linked to Raspberry Robin Malware - Sajin Shivdas | Cybersecurity\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/russian-criminal-organization-linked-to-raspberry-robin-malware\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/russian-criminal-organization-linked-to-raspberry-robin-malware\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/wp-content\\\/uploads\\\/2023\\\/01\\\/closeup-gray-orange-robin-bird-sitting-barbed-wire-blurred-background.jpg\",\"datePublished\":\"2022-09-04T22:42:54+00:00\",\"dateModified\":\"2023-03-27T08:44:10+00:00\",\"description\":\"Similarities between the Raspberry Robin USB-based worm and the Dridex malware loader suggest that it originated with the banned Russian ransomware gang\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/russian-criminal-organization-linked-to-raspberry-robin-malware\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/russian-criminal-organization-linked-to-raspberry-robin-malware\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/russian-criminal-organization-linked-to-raspberry-robin-malware\\\/#primaryimage\",\"url\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/wp-content\\\/uploads\\\/2023\\\/01\\\/closeup-gray-orange-robin-bird-sitting-barbed-wire-blurred-background.jpg\",\"contentUrl\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/wp-content\\\/uploads\\\/2023\\\/01\\\/closeup-gray-orange-robin-bird-sitting-barbed-wire-blurred-background.jpg\",\"width\":1500,\"height\":973},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/russian-criminal-organization-linked-to-raspberry-robin-malware\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Russian Criminal Organization Linked to Raspberry Robin Malware\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/#website\",\"url\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/\",\"name\":\"sajinshivdas.com\",\"description\":\"Cybersecurity - Information security Resources, Articles and Latest News\",\"publisher\":{\"@id\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/#\\\/schema\\\/person\\\/af1d121cbedd3ce64369f21a359ff2e6\"},\"alternateName\":\"Sajin Shivdas\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/#\\\/schema\\\/person\\\/af1d121cbedd3ce64369f21a359ff2e6\",\"name\":\"Sajin Shivdas\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/wp-content\\\/uploads\\\/2023\\\/01\\\/5dbd4f42-9550-4c99-82e9-34f3c99a2253.png\",\"url\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/wp-content\\\/uploads\\\/2023\\\/01\\\/5dbd4f42-9550-4c99-82e9-34f3c99a2253.png\",\"contentUrl\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/wp-content\\\/uploads\\\/2023\\\/01\\\/5dbd4f42-9550-4c99-82e9-34f3c99a2253.png\",\"width\":1000,\"height\":500,\"caption\":\"Sajin Shivdas\"},\"logo\":{\"@id\":\"https:\\\/\\\/sajinshivdas.com\\\/cybersecurity\\\/wp-content\\\/uploads\\\/2023\\\/01\\\/5dbd4f42-9550-4c99-82e9-34f3c99a2253.png\"},\"sameAs\":[\"http:\\\/\\\/sajinshivdas.com\\\/security\",\"www.linkedin.com\\\/in\\\/sajin-shivdas\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Russian Criminal Organization Linked to Raspberry Robin Malware - Sajin Shivdas | Cybersecurity","description":"Similarities between the Raspberry Robin USB-based worm and the Dridex malware loader suggest that it originated with the banned Russian ransomware gang","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/sajinshivdas.com\/cybersecurity\/russian-criminal-organization-linked-to-raspberry-robin-malware\/","og_locale":"en_US","og_type":"article","og_title":"Russian Criminal Organization Linked to Raspberry Robin Malware - Sajin Shivdas | Cybersecurity","og_description":"Similarities between the Raspberry Robin USB-based worm and the Dridex malware loader suggest that it originated with the banned Russian ransomware gang","og_url":"https:\/\/sajinshivdas.com\/cybersecurity\/russian-criminal-organization-linked-to-raspberry-robin-malware\/","og_site_name":"Sajin Shivdas | Cybersecurity","article_published_time":"2022-09-04T22:42:54+00:00","article_modified_time":"2023-03-27T08:44:10+00:00","og_image":[{"width":1500,"height":973,"url":"https:\/\/sajinshivdas.com\/cybersecurity\/wp-content\/uploads\/2023\/01\/closeup-gray-orange-robin-bird-sitting-barbed-wire-blurred-background.jpg","type":"image\/jpeg"}],"author":"Sajin Shivdas","twitter_misc":{"Written by":"Sajin Shivdas","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":["Article","BlogPosting"],"@id":"https:\/\/sajinshivdas.com\/cybersecurity\/russian-criminal-organization-linked-to-raspberry-robin-malware\/#article","isPartOf":{"@id":"https:\/\/sajinshivdas.com\/cybersecurity\/russian-criminal-organization-linked-to-raspberry-robin-malware\/"},"author":{"name":"Sajin Shivdas","@id":"https:\/\/sajinshivdas.com\/cybersecurity\/#\/schema\/person\/af1d121cbedd3ce64369f21a359ff2e6"},"headline":"Russian Criminal Organization Linked to Raspberry Robin Malware","datePublished":"2022-09-04T22:42:54+00:00","dateModified":"2023-03-27T08:44:10+00:00","mainEntityOfPage":{"@id":"https:\/\/sajinshivdas.com\/cybersecurity\/russian-criminal-organization-linked-to-raspberry-robin-malware\/"},"wordCount":871,"commentCount":0,"publisher":{"@id":"https:\/\/sajinshivdas.com\/cybersecurity\/#\/schema\/person\/af1d121cbedd3ce64369f21a359ff2e6"},"image":{"@id":"https:\/\/sajinshivdas.com\/cybersecurity\/russian-criminal-organization-linked-to-raspberry-robin-malware\/#primaryimage"},"thumbnailUrl":"https:\/\/sajinshivdas.com\/cybersecurity\/wp-content\/uploads\/2023\/01\/closeup-gray-orange-robin-bird-sitting-barbed-wire-blurred-background.jpg","keywords":["Malware","Vulnerabilities"],"articleSection":["Malware","Vulnerability"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/sajinshivdas.com\/cybersecurity\/russian-criminal-organization-linked-to-raspberry-robin-malware\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/sajinshivdas.com\/cybersecurity\/russian-criminal-organization-linked-to-raspberry-robin-malware\/","url":"https:\/\/sajinshivdas.com\/cybersecurity\/russian-criminal-organization-linked-to-raspberry-robin-malware\/","name":"Russian Criminal Organization Linked to Raspberry Robin Malware - Sajin Shivdas | Cybersecurity","isPartOf":{"@id":"https:\/\/sajinshivdas.com\/cybersecurity\/#website"},"primaryImageOfPage":{"@id":"https:\/\/sajinshivdas.com\/cybersecurity\/russian-criminal-organization-linked-to-raspberry-robin-malware\/#primaryimage"},"image":{"@id":"https:\/\/sajinshivdas.com\/cybersecurity\/russian-criminal-organization-linked-to-raspberry-robin-malware\/#primaryimage"},"thumbnailUrl":"https:\/\/sajinshivdas.com\/cybersecurity\/wp-content\/uploads\/2023\/01\/closeup-gray-orange-robin-bird-sitting-barbed-wire-blurred-background.jpg","datePublished":"2022-09-04T22:42:54+00:00","dateModified":"2023-03-27T08:44:10+00:00","description":"Similarities between the Raspberry Robin USB-based worm and the Dridex malware loader suggest that it originated with the banned Russian ransomware gang","breadcrumb":{"@id":"https:\/\/sajinshivdas.com\/cybersecurity\/russian-criminal-organization-linked-to-raspberry-robin-malware\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/sajinshivdas.com\/cybersecurity\/russian-criminal-organization-linked-to-raspberry-robin-malware\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/sajinshivdas.com\/cybersecurity\/russian-criminal-organization-linked-to-raspberry-robin-malware\/#primaryimage","url":"https:\/\/sajinshivdas.com\/cybersecurity\/wp-content\/uploads\/2023\/01\/closeup-gray-orange-robin-bird-sitting-barbed-wire-blurred-background.jpg","contentUrl":"https:\/\/sajinshivdas.com\/cybersecurity\/wp-content\/uploads\/2023\/01\/closeup-gray-orange-robin-bird-sitting-barbed-wire-blurred-background.jpg","width":1500,"height":973},{"@type":"BreadcrumbList","@id":"https:\/\/sajinshivdas.com\/cybersecurity\/russian-criminal-organization-linked-to-raspberry-robin-malware\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/sajinshivdas.com\/cybersecurity\/"},{"@type":"ListItem","position":2,"name":"Russian Criminal Organization Linked to Raspberry Robin Malware"}]},{"@type":"WebSite","@id":"https:\/\/sajinshivdas.com\/cybersecurity\/#website","url":"https:\/\/sajinshivdas.com\/cybersecurity\/","name":"sajinshivdas.com","description":"Cybersecurity - Information security Resources, Articles and Latest News","publisher":{"@id":"https:\/\/sajinshivdas.com\/cybersecurity\/#\/schema\/person\/af1d121cbedd3ce64369f21a359ff2e6"},"alternateName":"Sajin Shivdas","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/sajinshivdas.com\/cybersecurity\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/sajinshivdas.com\/cybersecurity\/#\/schema\/person\/af1d121cbedd3ce64369f21a359ff2e6","name":"Sajin Shivdas","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/sajinshivdas.com\/cybersecurity\/wp-content\/uploads\/2023\/01\/5dbd4f42-9550-4c99-82e9-34f3c99a2253.png","url":"https:\/\/sajinshivdas.com\/cybersecurity\/wp-content\/uploads\/2023\/01\/5dbd4f42-9550-4c99-82e9-34f3c99a2253.png","contentUrl":"https:\/\/sajinshivdas.com\/cybersecurity\/wp-content\/uploads\/2023\/01\/5dbd4f42-9550-4c99-82e9-34f3c99a2253.png","width":1000,"height":500,"caption":"Sajin Shivdas"},"logo":{"@id":"https:\/\/sajinshivdas.com\/cybersecurity\/wp-content\/uploads\/2023\/01\/5dbd4f42-9550-4c99-82e9-34f3c99a2253.png"},"sameAs":["http:\/\/sajinshivdas.com\/security","www.linkedin.com\/in\/sajin-shivdas"]}]}},"_links":{"self":[{"href":"https:\/\/sajinshivdas.com\/cybersecurity\/wp-json\/wp\/v2\/posts\/6452","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sajinshivdas.com\/cybersecurity\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sajinshivdas.com\/cybersecurity\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sajinshivdas.com\/cybersecurity\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sajinshivdas.com\/cybersecurity\/wp-json\/wp\/v2\/comments?post=6452"}],"version-history":[{"count":0,"href":"https:\/\/sajinshivdas.com\/cybersecurity\/wp-json\/wp\/v2\/posts\/6452\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sajinshivdas.com\/cybersecurity\/wp-json\/wp\/v2\/media\/6454"}],"wp:attachment":[{"href":"https:\/\/sajinshivdas.com\/cybersecurity\/wp-json\/wp\/v2\/media?parent=6452"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sajinshivdas.com\/cybersecurity\/wp-json\/wp\/v2\/categories?post=6452"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sajinshivdas.com\/cybersecurity\/wp-json\/wp\/v2\/tags?post=6452"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}