Raspberry Robin Returns: New Malware Campaign Spreading Through WSF Files

Researchers identified a March 2024 wave of the Raspberry Robin campaign distributing via heavily obfuscated Windows Script Files (WSFs) that perform anti-analysis and anti-VM checks, enforce a minimum Windows build, detect/avoid AV processes, add Microsoft Defender exclusions, and use curl to retrieve a main DLL payload; Raspberry Robin acts as a downloader for payloads such as SocGholish, Cobalt Strike, IcedID, BumbleBee, and TrueBot and is tied to the Storm-0856 cybercrime cluster.