"Raspberry Robin Malware Spreading Through WSF Files: How to Stay Safe"

A new wave of the Raspberry Robin malware campaign has been discovered, spreading through malicious Windows Script Files (WSFs) since March 2024. The malware, also known as QNAP worm, has evolved into a downloader for various other payloads and is linked to the broader cybercrime ecosystem. The latest distribution vector involves the use of heavily obfuscated WSF files offered for download via various domains and subdomains, with the malware employing anti-analysis and anti-virtual machine techniques to evade detection. Additionally, it configures Microsoft Defender Antivirus exclusion rules to avoid being scanned, posing a serious infection risk.