Threat Research

Raspberry Robin, or Roshtyak, is a malicious downloader active since 2021, primarily spreading via infected USB drives. It continues to evolve with enhanced evasion techniques and improved functionality despite limited public reporting. Our previous analysis covers its core behavior, while this blog highlights recent updates and capabilities....

Identifies the execution of a ".CPL" file from the user's temporary directory using the "Control_RunDLL" export function of the Shell32 DLL. This activity has been observed in several Raspberry Robin variants....

Discovered in 2021, Raspberry Robin (also known as Roshtyak) is a malicious downloader primarily spread via infected USB devices. It stands out for its unique binary obfuscation, extensive anti-analysis techniques, and privilege escalation exploits....

We identified a unique infection chain pattern distributing Raspberry Robin, traceable back to late October 2024. We suspect the initial zip downloads are distributed via embedded third-party ads on various sites attempting to monetize traffic. These zip archives and the extracted HTA files all share the same root name....