Introduction During our threat hunting exercises in recent months, we’ve started to observe a distinguishing pattern of msiexec.exe usage across different endpoints. As we drilled down to individual assets, we found traces of a recently discovered malware called Raspberry Robin. The RedCanary Research Team first coined the name for this malware in their blog post, and Sekoia … [Read more...] about Raspberry Robin: Highly Evasive Worm Spreads over External Disks
worm
Evolution of security: the story of the ILOVEYOU worm
Let’s take a trip down memory lane to May 2000. Just another day at the office: You turn on your work computer, connect to the internet and download the latest e-mail in the Microsoft Outlook client. You immediately notice a strange message with the subject line “ILOVEYOU.” A person you know confesses their love to you. Maybe a school friend… Wait, no! Even better — your older … [Read more...] about Evolution of security: the story of the ILOVEYOU worm
Microsoft Links Raspberry Robin USB Worm to Russian Evil Corp Hackers
Microsoft on Friday disclosed a potential connection between the Raspberry Robin USB-based worm and an infamous Russian cybercrime group tracked as Evil Corp. The tech giant said it observed the FakeUpdates (aka SocGholish) malware being delivered via existing Raspberry Robin infections on July 26, 2022. Raspberry Robin, also called QNAP Worm, is known to spread from a … [Read more...] about Microsoft Links Raspberry Robin USB Worm to Russian Evil Corp Hackers
Researchers Warn of Raspberry Robin’s Worm Targeting Windows Users
Cybersecurity researchers are drawing attention to an ongoing wave of attacks linked to a threat cluster tracked as Raspberry Robin that's behind a Windows malware with worm-like capabilities. Describing it as a "persistent" and "spreading" threat, Cybereason said it observed a number of victims in Europe. The infections involve a worm that propagates over removable USB … [Read more...] about Researchers Warn of Raspberry Robin’s Worm Targeting Windows Users
India’s Koo, a Twitter-like Service, Found Vulnerable to Critical Worm Attacks
Koo, India's homegrown Twitter clone, recently patched a serious security vulnerability that could have been exploited to execute arbitrary JavaScript code against hundreds of thousands of its users, spreading the attack across the platform. The vulnerability involves a stored cross-site scripting flaw (also known as persistent XSS) in Koo's web application that allows … [Read more...] about India’s Koo, a Twitter-like Service, Found Vulnerable to Critical Worm Attacks