Raspberry Robin USB Worm - wscript or msiexec Executing Shortcut or Script from Removable Drive

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects the execution of wscript.exe, msiexec.exe, or cmd.exe initiated with command lines pointing to script files (.js, .vbs) or shortcut files (.lnk) located on removable drives (d-z drive letters). This behavior is characteristic of the Raspberry Robin worm spreading via infected USB media.