Raspberry Robin Adopts Unique Evasion Techniques
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-1054 | Privilege Escalation in Microsoft Windows Win32k Kernel Driver (CVE-2020-1054) CVE-2020-1054 is an elevation-of-privilege flaw (CWE-787, an out-of-bounds memory access) in the Windows kernel-mode driver (win32k), which fails to properly handle objects in memory. To exploit it, an attacker who can already log on to an affected Windows machine must run a specially crafted application, which triggers the memory-handling error and allows arbitrary code execution in kernel mode. Successful exploitation effectively yields full SYSTEM-level control of the host: the attacker can install programs, view, change or delete any data, and create new accounts with full user rights. Affected products per the CPE data are Windows 7, 8.1, RT 8.1, Windows 10 versions 1507 through 1909, and Windows Server 1803 and 1903. The flaw was fixed in Microsoft's May 2020 Patch Tuesday, a public DrawIconEx-based local privilege escalation PoC exists, EPSS is 54.2% (99th percentile), and CISA added it to the KEV catalog on 2021-11-03, confirming exploitation in the wild; related threat reporting around this CVE ties it to malware campaigns such as PurpleFox and Raspberry Robin, while ransomware use is listed as unknown. Do: Apply Microsoft's May 2020 security updates (or any later cumulative update) to Windows 7, 8.1, RT 8.1, Windows 10 1507–1909, and Windows Server 1803/1903, per the CISA KEV required action; prioritize multi-user hosts such as RDS servers where low-privileged users can run code. For legacy systems that no longer receive updates (e.g., Windows 7/8.1 post-EOL), limit local logon and software-execution rights for untrusted users and monitor for local privilege escalation activity. | 7.0 | 54% | KEV PoC |
| mass≈1 billion Windows devices (global Windows 10 install base plus the legacy Windows 7/8.1 estate) | |
| CVE-2021-1732 | Out-of-Bounds Write Local Privilege Escalation in Microsoft Win32k (CVE-2021-1732) CVE-2021-1732 is a local elevation-of-privilege vulnerability (CWE-787, out-of-bounds write) in Microsoft's Win32k kernel driver, publicly characterized as an "offset confusion" in the Win32k ConsoleControl routine. It is triggered locally: a process with only low privileges can invoke the vulnerable Win32k functionality without any user interaction, causing a user-supplied offset/pointer to be mishandled in kernel mode and memory to be written out of bounds. An attacker who successfully exploits the flaw can execute code in the kernel and elevate to SYSTEM, gaining full control of the host — which makes it a valuable second-stage link in malware and ransomware chains. Any system running the affected Windows 10 releases (1803, 1809, 1909, 2004, 20H2) or Windows Server 2019/1909/2004/20H2 is exposed, though exploitation requires the attacker to already run code locally on the target. The flaw was fixed in Microsoft's February 2021 Patch Tuesday updates, was added to CISA's KEV catalog on 2021-11-03 with known ransomware use, and carries a very high EPSS score (78.4%, 100th percentile), indicating sustained exploitation pressure. Do: Apply Microsoft's February 2021 (or later) Windows cumulative security updates to all affected Windows 10 and Windows Server systems, per vendor instructions — CISA's KEV listing requires federal agencies to patch. Prioritize hosts exposed to untrusted local users or already compromised by malware (e.g., ransomware or Raspberry Robin activity, which has used chained Windows LPEs), and hunt on unpatched hosts for signs of post-exploitation privilege escalation to SYSTEM. | 7.8 | 78% | KEV ransomware PoC ×2 |
| mass≈1 billion+ Windows devices (the listed builds spanned the mainstream Windows 10/Server install base) |
Full article325 words · extracted from infosecurity-magazine.com · click to collapse
Threat actors relying on the Raspberry Robin malware have been observed adopting unique evasion techniques to avoid detection.
Security researchers at Check Point Research (CPR) published a new advisory on Tuesday describing the novel malware features and how defenders can guard systems against them.
“Anti-debugging and other evasions can be exhausting, and even more so when it comes to such obfuscation methods and volume of methods as Raspberry Robin implements,” wrote CPR security researcher Shavit Yosef. “This research aims to show plenty of methods with explanations of how they work and how to evade those evasions.”
Several of the new methods Raspberry Robin uses are related to its ability to avoid being run on virtual machines (VMs), which security researchers often use to analyze malware. This makes it harder for defenders to study the tool. Technical details to defend against them are available in the advisory.
Raspberry Robin also added other evasion techniques at many stages of its operation. CPR analyzed two new exploits the malware used to gain higher privileges on infected systems.
The first of them (CVE-2020-1054) takes advantage of a bug in the win32k window object, allowing it to write data outside of its intended boundaries. The exploit is only used by Raspberry Robin on Windows 7 systems.
The second exploit (CVE-2021-1732) is similar from a technical standpoint but targets Windows 10 systems with specific build numbers and checks if a particular patch is present. Yosef wrote that this exploit was used in the past as a zero-day by the Bitter APT group.
“Raspberry Robin implemented other cool tricks and exploits showing that he also has capabilities in the exploiting area,” the security researcher added. “Unfortunately, the world of evasions is only getting harder and more creative, so buckle up and pray that somebody already encountered this evasion before you.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/raspberry-robin-adopts-unique/