Microsoft has warned of discovery of a Windows worm on networks of hundreds of organisations in various industries. The malware referred to as “Raspberry Robin” is said to spread through USB devices. The worm was first spotted in September 2021 by intelligence analysts Red Canary, bleeping Computer reported. Now, the worm has been detected on the networks of multiple customer, many of whom are companies from the technology and manufacturing sectors. It requires a user to insert the USB device and click a malicious. LNK file. After that, the worm uses the Windows command prompt to launch an msiexec process and run a malicious file also present on the device. A connection is then established with a command and control server using a short URL, and if successfully, a number of malicious DLLs are downloaded and installed. The legitimare Windows utility odbcconf.exe is then used to execute the DLLs while the worm repeatedly attempts to connect to Tor network nodes. At least some of the command and control servers being used are thought to be infected QNAP NAS devices.
The malware introduced by the worm is capable of bypassing Windows User Account Control (UAC) and has already proven it can use the utilities available to the OS. So while nobody currently knows the objective of Raspberry Robin, the control it imposes over a network means new malware could be downloaded and deployed very quickly.
One of the first defences to deploy to protect against this worm, is to warn employees of the dangers of plugging in USB keys from unknown sources, including colleagues, friends, and devices found lying on the floor.
There are a number of unanswered questions about the worm, say Red Canary researchers. That includes how or where external drives are infected, or why it installs a malicious DLL. One hypothesis is that may be an attempt to establish persistence on an infected system.
“Perhaps our biggest question concerns the operators’ objectives,” they add. “Absent additional information on later-stage activity, it’s difficult to make inferences on the goal or goals of these campaigns.”
