IBM experts have confirmed functional similarities between a malicious component used in the Raspberry Robin infection chain and a Dridex malware loader. They found overlaps in the anti-analysis code and how the final payload is decoded in an analogous manner. Dridex is the handiwork of Evil Corp. Hence, it is likely that Evil Corp is also behind Raspberry Robin.