Meet the Low-Key Access Broker Supercharging Russian State Cybercrime

Raspberry Robin has progressed from USB-based worm delivery to a sophisticated initial-access broker that leverages compromised QNAP NAS, routers, and IoT devices, multilayer packing, and N-day exploits to sell access to other threat actors; researchers link its activity to Russian-aligned actors (including facilitation of GRU Unit 29155 operations), and its compromises enable rapid follow-on payloads across government and multiple industries globally.