Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
SecurityPlus
Contributor II

Raspberry Robin Now Spreading Through Windows Script Files

I was sent this article. It is amazing to me the amount of time that was invested in hiding the script and the related activity. Are there any tips or tricks to stopping melicious code like this?

 

https://threatresearch.ext.hp.com/raspberry-robin-now-spreading-through-windows-script-files/ 

1 Solution
AEK
SuperUser
SuperUser

Even if this worm is cleanable by FortiEDR and not FortiGate, it seems that some harmful traffic related to it can be stopped by FortiGate's IPS engine.

Below a screenshot from my FG IPS signatures.

rasp.png

AEK

View solution in original post

AEK
4 REPLIES 4
xshkurti
Staff
Staff

@SecurityPlus 
Check this link on how to be protected using FortiEDR
How FortiEDR protects against RaspberryRo... - Fortinet Community

SecurityPlus
Contributor II

Thank you. Sorry for the delay in responding. Curious if this malicious traffic were to try to pass through a well configured FortiGate if it would likely be stopped? If so, is there a particular firewall configuration that is particularly important to stopping this?

xshkurti
Staff
Staff

@SecurityPlus 
Knowing the vulnerability behavior, which is known to spread with a USB stick, it already infects a PC. Then a legit traffic is sent to some C2 servers around the world.


In this case, FortiEDR would be the protection and not rely entirely on FortiGate alone.

But in any case, it is good if you consult some of our Security Experts that might help you better discuss your security concerns from design prospective

AEK
SuperUser
SuperUser

Even if this worm is cleanable by FortiEDR and not FortiGate, it seems that some harmful traffic related to it can be stopped by FortiGate's IPS engine.

Below a screenshot from my FG IPS signatures.

rasp.png

AEK
AEK
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors