Raspberry Robin began as a USB worm that most teams dismissed as noise, then became a distribution channel that Microsoft saw handing infected networks to groups linked to Clop and LockBit ransomware. First identified in September 2021, it spread through shortcut files on infected USB drives and later through archives on Discord, Windows Script Files and malicious ads. Microsoft counted nearly 3,000 devices in almost 1,000 organisations with related alerts in a single 30-day window in 2022. This guide covers names, how the operators make money, ATT&CK v20 techniques, the identity consequences of an infection, and the controls that stop it. It draws on MITRE ATT&CK, Microsoft Threat Intelligence, Check Point Research and HP Threat Research, and is written for endpoint, SOC and desktop engineering teams. For removable media threats in general, see the USB Drop Attacks Guide.
Key takeaways
- Autorun is still the weak point. Microsoft notes that autorun is disabled by default but often re-enabled through legacy Group Policy, and some Raspberry Robin drives rely on it.
- It is an access broker, not an end payload. Microsoft saw infections lead to IcedID, Bumblebee, TrueBot, FakeUpdates, Cobalt Strike and finally Clop ransomware.
- Windows' own binaries do the work. The chain uses cmd.exe, msiexec.exe, rundll32.exe, odbcconf.exe, regsvr32.exe and fodhelper.exe, so application control and EDR process rules matter more than file signatures.
- Patching windows are shrinking. Check Point reports Raspberry Robin used CVE-2023-36802 about a month after disclosure, against a year for an earlier exploit.
- Delivery keeps changing. HP found Windows Script Files in March 2024 that no antivirus engine on VirusTotal flagged at the time.
Who they are (names and aliases)
MITRE ATT&CK describes Raspberry Robin (S1130) as initial access malware first identified in September 2021 and active through early 2024 in its dataset, notable for spreading via infected USB devices containing a malicious LNK object. The name covers both the malware and its operators.
| Name | Source | What it refers to |
|---|---|---|
| Raspberry Robin (S1130) | MITRE ATT&CK; Red Canary (named May 2022, per Microsoft) | The worm and loader, and the operators |
| Roshtyak | MITRE ATT&CK (Avast naming) | The DLL component in the infection chain |
| Storm-0856 (formerly DEV-0856) | Microsoft; MITRE ATT&CK | Microsoft's tracking of the USB-based operators |
| Fauppod | Microsoft | A related family delivered by another cluster through legitimate cloud services |
No source read for this page names individual operators; this page names none. For how Microsoft's DEV and Storm names map to weather-themed names, see the Threat Actor Naming Conventions Guide.
Targeting and motivation
- Motivation: financial, through selling or sharing access. Microsoft describes Raspberry Robin as part of a larger ecosystem facilitating pre-ransomware activity.
- Breadth: MITRE says it has been used against various industries and geographies. Infections arrive wherever USB drives are shared, which favours manufacturing, print shops, education and any site with shared kiosks.
- Who buys: Microsoft linked follow-on activity to clusters it now calls Manatee Tempest (overlapping Evil Corp, LockBit deployment in 2021), Lace Tempest (overlapping FIN11 and TA505, Clop deployment in October 2022) and Mustard Tempest (FakeUpdates). See the TA505 Threat Actor Profile Guide, the Evil Corp Threat Actor Profile Guide and the SocGholish and Fake Browser Update Malware Guide.
- Evolution: Check Point documented RAR archives hosted on Discord in 2023 and 2024; HP reported web-downloaded Windows Script Files from March 2024, following archives and malicious ads.
Tactics and techniques (MITRE ATT&CK)
All IDs below are ATT&CK v20 techniques recorded against S1130. Defence impairment now sits under tactic TA0112 Defense Impairment.
| Tactic | Technique | What sources describe | Primary defence |
|---|---|---|---|
| Initial access and lateral movement | T1091 Replication Through Removable Media | Infected USB drives carrying a shortcut disguised as a folder | Disable autorun; block untrusted executables from USB |
| Execution | T1204 User Execution; T1059.003 Windows Command Shell | User opens the shortcut; cmd.exe starts the chain | Show file extensions; user awareness on USB |
| Resource development | T1583.008 Malvertising; T1583.001 Domains | Malicious ads and rotating domains for later delivery | Ad and newly registered domain filtering |
| Stealth | T1218.007 Msiexec; T1218.008 Odbcconf; T1218.010 Regsvr32; T1218.011 Rundll32 | Remote installer fetched by msiexec, then proxy execution | WDAC or AppLocker rules for proxy binaries |
| Stealth | T1574.001 DLL; T1036.008 Masquerade File Type; T1055.012 Process Hollowing | Signed executable side-loading a DLL (Check Point); injection into system processes | EDR side-loading and injection rules |
| Privilege escalation | T1548.002 Bypass User Account Control | fodhelper.exe UAC bypass (Microsoft); kernel exploits (Check Point) | No local admin; UAC at highest level; patch quickly |
| Persistence | T1547.001 Registry Run Keys / Startup Folder | User RunOnce key (Microsoft) | Alert on Run and RunOnce writes to unusual paths |
| Stealth and discovery | T1497.001 System Checks; T1480 Execution Guardrails; T1622 Debugger Evasion | Exits on virtual machines, servers and analysis tools | Behaviour detection on real endpoints |
| Defence impairment | T1685 Disable or Modify Tools | Defender exclusion for the whole main drive (HP) | Tamper protection; alert on exclusion changes |
| Command and control | T1071.001 Web Protocols; T1571 Non-Standard Port | Tor-hosted command and control; payloads on compromised QNAP NAS devices | Block Tor egress; alert on Tor from system processes |
Check Point reports the use of local privilege escalation exploits CVE-2023-29360 and CVE-2023-36802 (Microsoft Streaming Service) and, earlier, CVE-2021-1732 (Win32k). All three are in the CISA KEV catalog. For shortcut abuse in general, see the Malicious LNK Files Guide.
How they abuse identities and credentials
- The logged-on user is the foothold: the worm runs as whoever opened the shortcut. Their SSO sessions, browser credentials and file share access pass to the next operator.
- Local admin users make escalation trivial: the fodhelper UAC bypass only helps if the user is already in the local Administrators group. Removing local admin rights removes that path.
- Shared kiosk and production accounts: shared logons on shop-floor PCs, print stations and lab machines, where USB use is common, mean an infection cannot be tied to one person and the account is rarely rotated. These are effectively non-human accounts; see the Human vs Non-Human Identity guide.
- Hand-off to ransomware affiliates: Microsoft saw Cobalt Strike sessions and Clop deployment after Raspberry Robin. LSASS credential theft is the usual next step, which is why Microsoft lists the ASR rule blocking credential stealing from lsass.exe among its mitigations.
- Compromised NAS devices: payloads were hosted on compromised QNAP NAS devices, a reminder that internet-facing storage with weak admin credentials becomes attacker infrastructure.
Notable incidents
| Date | Event | Source |
|---|---|---|
| September 2021 | Raspberry Robin first identified | MITRE ATT&CK |
| May 2022 | Red Canary reports the USB worm | Microsoft |
| July 2022 | Infected hosts seen installing FakeUpdates | Microsoft |
| From 19 September 2022 | Follow-on payloads IcedID, then Bumblebee and TrueBot | Microsoft |
| October 2022 | Cobalt Strike activity leading to Clop ransomware by Lace Tempest; nearly 3,000 devices in almost 1,000 organisations alerting in 30 days | Microsoft |
| August and October 2023 | Exploits for CVE-2023-29360 and CVE-2023-36802 used shortly after disclosure; Discord-hosted archives | Check Point |
| March 2024 | Windows Script File delivery with no antivirus detections at analysis time | HP Threat Research |
No law enforcement takedown of Raspberry Robin is recorded in the sources read for this page.
Detection and defence
What to monitor
| Signal | Data source | Why it matters |
|---|---|---|
| Shortcut on a removable drive launching cmd.exe | EDR process tree; Sysmon Event ID 1 | The original infection chain |
| msiexec.exe installing from a remote URL, especially by IP or unusual port | EDR; Security Event ID 4688 with command line | Second stage fetched from compromised NAS devices |
| rundll32, regsvr32 or dllhost connecting to Tor or making outbound connections | EDR network events; Sysmon Event ID 3; firewall | Injected command and control |
| fodhelper.exe spawning unexpected children | EDR; Sysmon Event ID 1 | UAC bypass |
| New Defender exclusions | Defender operational log Event ID 5007 | HP saw a whole-drive exclusion |
| wscript.exe running .wsf files from Downloads | EDR | 2024 delivery route |
| Signed Microsoft binary in a user folder loading an unsigned or invalid-signature DLL | EDR image load; Sysmon Event ID 7 | DLL side-loading from Discord archives |
Phased response plan
- Find and kill autorun: audit Group Policy for legacy settings that re-enable autorun; set "Turn off AutoPlay" for all drives and "Set the default behavior for AutoRun" to do not execute. Roll out by OU and verify with a test USB.
- Turn on the Microsoft-recommended ASR rules: block untrusted and unsigned processes that run from USB, block potentially obfuscated scripts, block executables unless they meet prevalence, age or trusted-list criteria, and block credential stealing from lsass.exe. Run two weeks in audit, review exceptions, then block; disable a single rule to roll back.
- Control removable media: where business allows, restrict USB storage to approved encrypted devices, and scan removable drives on insertion. See the Removable Media and USB Control Guide.
- Restrict proxy execution: WDAC or AppLocker rules stopping msiexec, odbcconf, regsvr32 and rundll32 from loading content from user-writable or remote paths.
- Remove local admin and patch fast: standard user accounts, Windows LAPS, and a short SLA for KEV-listed Windows privilege escalation flaws.
- Treat an infection as pre-ransomware: isolate, rebuild, revoke the user's sessions, reset credentials and hunt for Cobalt Strike or other follow-on tools.
Decision guidance
- Block USB storage or control it: offices can usually block USB mass storage outright. Factories, labs and field teams often cannot, so use allowlisted devices, scanning kiosks and the USB ASR rule instead.
- Small organisations: disabling autorun, turning on tamper protection and the four ASR rules, and removing local admin rights gives most of the protection at no cost.
- Large organisations: add device control by hardware ID, EDR rules for the process chains above, and Tor egress blocking at the proxy.
Metrics
- Percentage of endpoints with autorun disabled for all drives (verified by configuration scan).
- Percentage of endpoints with the four recommended ASR rules in block mode.
- Percentage of users without local admin rights.
- Days to deploy patches for KEV-listed Windows privilege escalation flaws.
- Number of endpoints making Tor connections per month (target zero outside approved use).
Framework mapping
| Control area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Removable media restrictions | MP-7 | PR.PS-01 |
| Malicious code protection | SI-3 | DE.CM-09 |
| Least functionality and application control | CM-7, CM-7(5) | PR.PS-01 |
| Least privilege | AC-6 | PR.AA-05 |
| Flaw remediation | SI-2 | PR.PS-02 |
| Monitoring | SI-4 | DE.CM-01 |
Common failure patterns
- Legacy GPOs re-enabling autorun: Microsoft calls this out directly; nobody remembers why the setting exists.
- Treating worm alerts as low severity: Raspberry Robin's value is the access it sells; the next stage may be ransomware.
- Hash-based blocking only: HP's scripts were unflagged at analysis time and the chain changes often.
- Slow privilege escalation patching: Check Point's timeline shows exploitation weeks after disclosure.
- Shared accounts on USB-heavy machines: infections cannot be traced and credentials are never rotated.
Practitioner checklist
- Audit and remove Group Policy settings that re-enable autorun; turn off AutoPlay for all drives.
- Enable the USB, obfuscated script, prevalence and LSASS ASR rules in block mode after audit.
- Enable Defender tamper protection and alert on exclusion changes (Event ID 5007).
- Restrict USB storage to approved devices where the business allows.
- Apply WDAC or AppLocker rules to msiexec, odbcconf, regsvr32 and rundll32.
- Remove local admin rights and patch KEV-listed privilege escalation flaws within days.
- Block Tor egress and alert on Tor from system processes.
- Replace shared logons on kiosks and shop-floor PCs with named or managed accounts.
- Respond to any infection with rebuild, session revocation and a follow-on hunt.
Standards and references
- MITRE ATT&CK: Raspberry Robin (S1130)
- Microsoft Threat Intelligence: Raspberry Robin worm part of larger ecosystem facilitating pre-ransomware activity
- CISA: Known Exploited Vulnerabilities Catalog
- Check Point Research: Raspberry Robin Keeps Riding the Wave of Endless 1-Days
- HP Threat Research: Raspberry Robin Now Spreading Through Windows Script Files
- MITRE ATT&CK: Replication Through Removable Media (T1091)
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: USB Drop Attacks Guide · Removable Media and USB Control Guide · Latrodectus and Bumblebee Loaders Guide · Initial Access Brokers Guide · Malware Loaders and Droppers Guide