Raspberry Robin Operators Selling Access To Companies

This switch in tactics by the Clop threat group is not uncommon amongst these groups. Rapidly changing tactics and leveraging dark web Malware-as-a-Service (MaaS) offerings allows threat groups to infect companies at a faster rate since they do not have to wait on a successful phishing campaign. Illicit access is frequently brokered in the underground economy. To mitigate the risks of attacks similar to Raspberry Robin, a good rule amongst organizations is to never use USB drives that are not trusted – particularly those that are unknown. If a USB drive is found randomly on the ground, it should be turned into the security team for evaluation.

Raspberry Robin operators are selling initial access to compromised enterprise networks to ransomware gangs