MALWARE FAMILY

Raspberry Robin

Internal ID: win.raspberry_robin

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Worm spread by external drives that leverages Windows Installer to reach out to QNAP-associated domains and download a malicious DLL.

Threat Analysis

Raspberry Robin is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→http://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/

→https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/

→https://blogs.cisco.com/security/raspberry-robin-highly-evasive-worm-spreads-over-external-disks

→https://darktrace.com/blog/the-early-bird-catches-the-worm-darktraces-hunt-for-raspberry-robin

→https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/

→https://harfanglab.io/en/insidethelab/raspberry-robin-and-its-new-anti-emulation-trick/

→https://redcanary.com/blog/raspberry-robin/

→https://research.checkpoint.com/2023/raspberry-robin-anti-evasion-how-to-exploit-analysis

→https://research.checkpoint.com/2023/raspberry-robin-anti-evasion-how-to-exploit-analysis/

→https://research.checkpoint.com/2024/raspberry-robin-keeps-riding-the-wave-of-endless-1-days/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.raspberry_robin

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Raspberry Robin