Raspberry Robin uses mixed-case letters for filenames and commands to evade detection.6
tool
Raspberry Robin S1130
- Type
- malware
- Platform
- Windows
- Created
- 17 May 2024
- Last modified
- 23 July 2024
Raspberry Robin is initial access malware first identified in September 2021, and active through early 2024. The malware is notable for spreading via infected USB devices containing a malicious LNK object that, on execution, retrieves remote hosted payloads for installation. Raspberry Robin has been widely used against various industries and geographies, and as a precursor to information stealer, ransomware, and other payloads such as SocGholish, Cobalt Strike, IcedID, and Bumblebee.[1][2][3] The DLL componenet in the Raspberry Robin infection chain is also referred to as "Roshtyak."[4] The name "Raspberry Robin" is used to refer to both the malware as well as the threat actor associated with its use, although the Raspberry Robin operators are also tracked as Storm-0856 by some vendors.[5]
41
TechniquesTop 2%
10
TacticsTop 6%
0
Threat groupsNone recorded
0
CampaignsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference S1130
Raspberry Robin contains multiple payloads that are packed for defense evasion purposes and unpacked on runtime.7
Raspberry Robin determines whether it is successfully running on a victim system by querying the running account information to determine if it is running in Session 0, indicating running with elevated privileges.8
Raspberry Robin will execute its payload prior to initializing command and control traffic by impersonating one of several legitimate program names such as dllhost.exe, regsvr32.exe, or rundll32.exe.9
Raspberry Robin has historically been delivered via infected USB drives containing a malicious LNK object masquerading as a legitimate folder.10
Raspberry Robin can execute via LNK containing a command to run a legitimate executable, such as wmic.exe, to download a malicious Windows Installer (MSI) package.11
Standing S1130
Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques41Top 2%
98th percentile · 98% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.
Tactics10Top 6%
94th percentile · 94% of 825 ATT&CK software entries have this many tactics spanned or fewer.
Threat groups061% tie · 22 values
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
Campaigns085% tie · 8 values
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique17med40th pct
40th percentile · 60% of 825 ATT&CK software entries have more detection rules per technique.
Tests / technique4med
Detection coverage S1130
1489 distinct rules cover the 41 techniques recorded for this tool. The 1582 technique-to-rule mappings resolve to 1489 distinct rules, because one rule can cover several techniques. 1030 Sigma · 459 Splunk.
38 covered by at least one rule3 with no coverage1489 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org