Raspberry Robin devs are buying exploits for faster attacks

Check Point Research reports that Raspberry Robin operators are increasingly acquiring and integrating one-day and zero-day exploits—sometimes within weeks of disclosure—likely from external exploit developers, enabling faster and more effective infections; the loader also received updates adding anti-analysis and shutdown-survival features and is used widely by major criminal groups.