Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 995348" data-attributes="member: 32260">SWH vs. Raspberry Robin worm[URL unfurl=&quot;true&quot;]https://www.cybereason.com/blog/threat-alert-raspberry-robin-worm-abuses-windows-installer-and-qnap-devices[/URL][URL unfurl=&quot;true&quot;]https://malwaretips.com/threads/microsoft-finds-raspberry-robin-worm-in-hundreds-of-windows-networks.114615/[/URL][URL unfurl=&quot;true&quot;]https://www.bleepingcomputer.com/news/security/microsoft-finds-raspberry-robin-worm-in-hundreds-of-windows-networks/[/URL][URL unfurl=&quot;true&quot;]https://www.bleepingcomputer.com/news/security/new-raspberry-robin-worm-uses-windows-installer-to-drop-malware/[/URL]It is a typical attack via an infected USB drive that contains a malicious shortcut (.lnk&nbsp; file) masquerading as a legitimate folder on a USB device. Opening the fake folder starts the infection chain.[ATTACH=full]267830[/ATTACH]SWH can block such attacks by default due to the special SRP restrictions for shortcuts. The shortcuts are rarely restricted in the business environment even for USB drives. Furthermore, the Applocker and Microsoft Application Control cannot block shortcuts and most administrators do not know how to effectively manage the shortcuts via SRP.Edit.This thread can be also blocked by FirewallHardening tool - the LOLBin msiexec.exe will be prevented from downloading the malicious DLL from the URL.</blockquote>

[QUOTE="Andy Ful, post: 995348, member: 32260"] [B][SIZE=5]SWH vs. Raspberry Robin worm[/SIZE][/B] [URL unfurl="true"]https://www.cybereason.com/blog/threat-alert-raspberry-robin-worm-abuses-windows-installer-and-qnap-devices[/URL] [URL unfurl="true"]https://malwaretips.com/threads/microsoft-finds-raspberry-robin-worm-in-hundreds-of-windows-networks.114615/[/URL] [URL unfurl="true"]https://www.bleepingcomputer.com/news/security/microsoft-finds-raspberry-robin-worm-in-hundreds-of-windows-networks/[/URL] [URL unfurl="true"]https://www.bleepingcomputer.com/news/security/new-raspberry-robin-worm-uses-windows-installer-to-drop-malware/[/URL] It is a typical attack via an infected USB drive that contains a malicious shortcut (.lnk file) masquerading as a legitimate folder on a USB device. Opening the fake folder starts the infection chain. [ATTACH type="full" alt="1656780910722.png"]267830[/ATTACH] SWH can block such attacks by default due to the special SRP restrictions for shortcuts. The shortcuts are rarely restricted in the business environment even for USB drives. Furthermore, the Applocker and Microsoft Application Control cannot block shortcuts and most administrators do not know how to effectively manage the shortcuts via SRP. Edit. This thread can be also blocked by FirewallHardening tool - the LOLBin msiexec.exe will be prevented from downloading the malicious DLL from the URL. [/QUOTE]

Verification