Raspberry Robin
Software · ATTACK:enterprise:S1130
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1130",
"title": "Raspberry Robin",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1130",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--4e385fa6-ebe0-43fc-9ccf-5b51b5dc4d79",
"external_id": "S1130",
"domain": "enterprise",
"created": "2024-05-17T13:11:28.925Z",
"modified": "2024-07-23T18:47:58.066Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "TrendMicro RaspberryRobin 2022",
"url": "https://www.trendmicro.com/en_us/research/22/l/raspberry-robin-malware-targets-telecom-governments.html"
},
{
"source_name": "Avast RaspberryRobin 2022",
"url": "https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/"
},
{
"source_name": "RedCanary RaspberryRobin 2022",
"url": "https://redcanary.com/blog/threat-intelligence/raspberry-robin/"
},
{
"source_name": "Microsoft RaspberryRobin 2022",
"url": "https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/"
},
{
"source_name": "HP RaspberryRobin 2024",
"url": "https://threatresearch.ext.hp.com/raspberry-robin-now-spreading-through-windows-script-files/"
}
]
}Explicit source assertions (41)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--030506d0-28fa-4a37-8375-037f7887ccff
TrendMicro RaspberryRobin 2022 · HP RaspberryRobin 2024ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ae86b10-69a4-4e9d-9b31-403dc08be50f
HP RaspberryRobin 2024ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11764f59-a7b9-4dff-8e37-471d739f5343
HP RaspberryRobin 2024ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b2eddbb-5a76-4488-9b65-b6ead43c2ddc
TrendMicro RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1102
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ebc8fee-78fd-4570-9fcd-060f4213b202
HP RaspberryRobin 2024ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1480
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--23b1bbb5-ab75-42f7-8bc9-d1c918f6817d
TrendMicro RaspberryRobin 2022 · HP RaspberryRobin 2024ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2e443cd2-b77f-4bb9-8bbd-82e11ab389f2
TrendMicro RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1559
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f1cb78e-3859-4e7f-976e-ddb791ffdad3
TrendMicro RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1571
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30cfec26-a5ff-460d-876c-ca7f9d1e639f
RedCanary RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--421b0dc2-fc78-4eb3-a336-ce8e4febccef
TrendMicro RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47b6edf8-f827-4ecc-8c83-007bb2553f5b
TrendMicro RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1218.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4db08a6d-ecbb-4a70-b0e5-9dac4dfb1517
RedCanary RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4dfbd868-5ab0-47c9-822e-a20db55dced5
TrendMicro RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--538697e9-2dda-43cb-ba43-208402f62f9d
RedCanary RaspberryRobin 2022 · HP RaspberryRobin 2024ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1574
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--59720c1c-115a-4206-aaa0-42ec4b03f6eb
TrendMicro RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1036.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a6a649a-5c23-4c2c-852a-d7df27abcf6c
RedCanary RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1091
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66810009-f426-4cee-8514-21d00753ae7a
TrendMicro RaspberryRobin 2022 · RedCanary RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6731a2dc-622a-4547-9b43-3eba8443dd49
RedCanary RaspberryRobin 2022 · HP RaspberryRobin 2024ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1055.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71db7381-ad59-4eb0-80b4-505c38eea9d2
TrendMicro RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1583.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72ebbe49-a354-4894-bfa2-06016f3d1ae6
RedCanary RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--74b6a6bc-5cd9-4699-aaff-a8984552e18b
HP RaspberryRobin 2024ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--778ab7aa-b85b-4d60-b203-00eff3f4b120
TrendMicro RaspberryRobin 2022 · HP RaspberryRobin 2024ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9137e2ff-166c-4d99-80e8-2694f262626c
TrendMicro RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1559.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9180d2f8-0bfe-40f3-a92b-36de31df76b4
TrendMicro RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91e69232-941e-43bf-9f10-b0e4cf8b43d1
HP RaspberryRobin 2024ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91f0a77b-0c70-425e-afe0-af5f8296c434
RedCanary RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1218.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9648bb23-1d68-4d76-bc42-e371889e4acf
RedCanary RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ad1d50a-31b2-4fc6-ac22-f83f68e97a15
RedCanary RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1548
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f30368d-3656-4ba1-8e53-94d5721f9241
TrendMicro RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1204
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6a6e8e2-c9c2-40b9-b410-ea84b2c43caf
Microsoft RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0e22e39-2b6c-4b27-8fd1-e9855194449e
TrendMicro RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1583.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b9c55e61-5864-45a1-91a7-91901f843678
HP RaspberryRobin 2024ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c5d32f1b-d4c1-4811-9793-ee55e663a2d6
HP RaspberryRobin 2024ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c9a2ee9a-4787-47c0-9cdc-f52735f066ad
TrendMicro RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d07fa408-1a12-443f-a280-75fbe4447f6f
HP RaspberryRobin 2024ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1070.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d788ad3e-64e3-41ac-9075-2732d95afb57
Microsoft RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1071
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d863f0be-98bb-42d5-a584-f48fc43022aa
TrendMicro RaspberryRobin 2022 · RedCanary RaspberryRobin 2022 · HP RaspberryRobin 2024ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d880af17-1184-4c4e-8550-665944d16a69
RedCanary RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d99149ea-7a52-455c-a56d-1f78a727a846
RedCanary RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1218.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dda729e3-eb8c-4c4d-a2cf-b34c5f9f8c52
TrendMicro RaspberryRobin 2022 · RedCanary RaspberryRobin 2022ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1059
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f34e6a88-bb49-47cc-b0bc-1d2abb63aa56
HP RaspberryRobin 2024