Raspberry Robin is a Windows worm first introduced in 2021 and is known for establishing a malicious foothold in victim devices in order to deliver some of the most prevalent forms of malware including SocGholish, Cobalt Strike, and IcedID. Raspberry Robin has been known to initially infect victim computers through compromised USB devices, RAR files hosted on Discord, and ZIP files contained in malicious advertisements and downloaded via the web browser. Researchers have now identified a new infection method via Windows Script Files (.wsf) which are hosted on malicious domains and subdomains controlled by threat actors. The WSF file performs as a downloader and retrieves the main DLL payload from a compromised remote server using the curl command. Raspberry Robin is noted for its sophisticated obfuscation and anti-analysis techniques deployed to evade detection and hinder discovery. The Raspberry Robin script runs a series of checks on the victim environment and aborts execution should a check fail. The checks include whether the script is being run in a virtualized environment, the windows operating system, and whether certain anti-virus programs are running. Importantly, the Raspberry Robin scripts are not currently classified as malicious by anti-virus scanners on Virus Total, which is reflective of the evasiveness of the malware. Identifying this malware early in the infection chain should be a high priority for security teams as it is a precursor to more malicious malware such as infostealers and ransomware. CTIX analysts recommend blocking the indicators of compromise (IOCs) associated with this campaign. CTIX analysts will continue to report on new and evolving malware campaigns.