APT / THREAT GROUP

Raspberry Robin

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Worm spread by external drives that leverages Windows Installer to reach out to QNAP-associated domains and download a malicious DLL.

Threat Analysis

Raspberry Robin is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→http://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/

→https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/

→https://blogs.cisco.com/security/raspberry-robin-highly-evasive-worm-spreads-over-external-disks

→https://darktrace.com/blog/the-early-bird-catches-the-worm-darktraces-hunt-for-raspberry-robin

→https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/

Quick Facts

TypeAPT / Threat Group

Aliases5

Also Known As

RaspberryRobinLINK_MSIEXECwin.raspberry_robinQNAP-WormRaspberry Robin

External Intelligence

Malpedia: win.raspberry_robin

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Raspberry Robin