Earth Berberoka
Also known as GamblingPuppet
According to TrendMicro, Earth Berberoka is a threat group originating from China that mainly focuses on targeting gambling websites. This group's campaign uses multiple malware families that target the Windows, Linux, and macOS platforms that have been attributed to Chinese-speaking actors. Aside from using tried-and-tested malware families that have been upgraded, such as PlugX and Gh0st RAT, Earth Berberoka has also developed a brand-new complex, multistage malware family, which has been dubbed PuppetLoader.
Targets: Gambling Websites, Information technology, Electronics Manufacturers, Education, China, United States, Hong Kong, Malaysia, Taiwan
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
No posts or advisories have named this actor recently.
References
- https://documents.trendmicro.com/assets/white_papers/wp-operation-earth-berberoka.pdf
- https://www.trendmicro.com/en_us/research/22/d/new-apt-group-earth-berberoka-targets-gambling-websites-with-old.html
- https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt
- https://documents.trendmicro.com/assets/txt/earth-berberoka-linux-iocs-2.txt
- https://documents.trendmicro.com/assets/txt/earth-berberoka-macos-iocs-2.txt
- https://documents.trendmicro.com/assets/txt/earth-berberoka-domains-2.txt
- https://www.youtube.com/watch?v=QXGO4RJaUPQ
- https://www.botconf.eu/wp-content/uploads/2022/05/Botconf2022-40-LunghiHorejsi.pdf
- https://securelist.com/diceyf-deploys-gameplayerframework-in-online-casino-development-studio/107723/
- https://www.trendmicro.com/en_us/research/22/h/irontiger-compromises-chat-app-Mimi-targets-windows-mac-linux-users.html
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.