For nearly a year, Red Canary has been tracking a worm spread by external drives that leverages Windows Installer to reach out to QNAP-associated domains and download a malicious DLL.

Watch Red Canary's Paul Michaud walk through four Atomic Red Team tests that will help you emulate behaviors associated with Raspberry Robin. Are you able to observe, detect, or prevent infection?

We developed this atomic specifically to emulate Raspberry Robin. It uses the “standard-in” command prompt feature to read and execute a file via cmd.exe.

This atomic retrieves an arbitrary MSI file from a remote IP address and executes it.

This atomic uses odbcconf.exe to load and execute a locally stored DLL.

This atomic emulates the rundll32.exe process start and the network connection (with a corresponding command line).

First-time contributor ruyek-git created a test that emulates malicious use of the Python pty module observed by Volexity, as part of their investigation into widespread exploitation of CVE-2022-26134, an unauthenticated remote code execution vulnerability in Atlassian Confluence.

You can now import Atomic Red Team execution logs into VECTR, a free purple team reporting tool. Atomic Red Team maintainer Carrie Roberts shows you how in a new video from our friends at Antisyphon Training.