It’s likely the group behind the worm called Raspberry Robin is just testing the waters — launching attacks against telecommunications companies and governments across Australia, Europe, and Latin America to see how far their malware can spread — for now.
Researchers at Trend Micro have been tracking Raspberry Robin since September and are warning the worm is notable for its 10 layers of obfuscation and its ability to deploy a fake payload to throw off detection efforts.
Raspberry Robin infected thousands of endpoints in October. Both October’s endpoint attacks and the latest targeting of governments and the telecom sector relied on a malicious USB for initial infection.
“Our initial analysis of the malware, which compromised a number of organizations toward the end of September, showed that while the main malware routine contains both the real and fake payloads, it loads the fake payload once it detects sandboxing tools to evade security and analytics tools from detecting and studying the malware’s real routine,” Trend Micro reported, adding the team will continue to track the malware’s activities.
