Raspberry Robin: A global USB malware campaign providing access to ransomware operators

This blog summarizes an active, global USB-borne malware campaign named Raspberry Robin that spreads via malicious LNK files on USB drives (potentially originating from infected printers/print shops), uses compromised NAS devices (QNAP/Acrobox) as C2 infrastructure, and acts as a precursor to high-profile ransomware via loaders like IcedID, Bumblebee, SocGholish and Truebot; it also provides detection advice (Splunk SPL rules), YARA hunting methodology and a table of IOCs (SHA256s, filenames, embedded domains).