The Raspberry Robin worm is incorporating one-day exploits almost as soon as they're developed, in order to improve on its privilege escalation capabilities.
Researchers from Check Point suspect that the developers behind the initial access tool are contracting with Dark Web exploit traffickers, allowing them to quickly incorporate new exploits for obtaining system-level privileges before such exploits are disclosed to the public, and before many affected organizations have gotten around to patching their associated vulnerabilities.
Raspberry Robin: Incorporating Exploits Faster Now Raspberry Robin was first discovered in 2021, and outed in a Red Canary blog post the following year.
In the time since, its developers have become much more proactive, upgrading their tool in a fraction of the time they used to take.
The Win32k Windows driver bug was first disclosed in February of 2021, but it was only integrated into Raspberry Robin the following year.
Raspberry Robin was already exploiting it by August, while a public exploit wouldn't come to light until the following month.
Then there was CVE-2023-36802, a similar bug in Microsoft Stream with a 7.8 CVSS rating.
First disclosed on September 12, it was being exploited by Raspberry Robin by early October, again before any public exploit was released.
In other words, the progression of the time the group takes to weaponize vulnerabilities after disclosure has gone from one year, to two months, to two weeks.
To explain their quick work, Check Point suggests that the worm developers are either purchasing their exploits from one-day developers on the Dark Web, or developing them themselves.
Certain misalignments between the worm and exploit codes suggest that the former scenario is more likely.
A Widespread, Effective Initial Access Cyber Threat In only its first year active, Raspberry Robin was already one of the world's most popular worms, with thousands of infections per month.
Red Canary tracked it as the seventh most prevalent threat of 2022, with its numbers only growing month-over-month.
Nowadays, Raspberry Robin is a popular initial access option for threat actors like Evil Corp, TA505, and more, contributing to major breaches of public and private sector organizations.
This Cyber News was published on www.darkreading.com. Publication date: Mon, 12 Feb 2024 22:20:21 +0000