Earth BerberokaThreat actor
- gamblingpuppet
According to TrendMicro, Earth Berberoka is a threat group originating from China that mainly focuses on targeting gambling websites. This group's campaign uses multiple malware families that target the Windows, Linux, and macOS platforms that have been attributed to Chinese-speaking actors.From MISP Galaxy
Last reported 10 days ago, by Sekoia.io4 reports
ATT&CK techniques
6 of 14 · each with the sentence it comes from- T1003.007Proc Filesystem
“…unt mode is enabled, the agent bind-mounts over its own /proc/<pid> entry, disrupting inspection of the running process through the proc filesystem.”
- T1014Rootkit
“… and mode, the C2 domain, the TLS SNI camouflage value used for the certificates, and the directory, filename, and loader names for the rootkit.”
- T1056.001Keylogging
“Researchers developed a static deobfuscation pipeline that recovered readable code, revealing keylogging, browser credential theft, HTTPS interception, additional encryption, and newer variants targeting macOS systems.”
- T1070.006Timestomp
“What follows is a deliberate effort to hide the intrusion: the script deletes the source and all build artifacts, then timestomps the resulting .so and its load-configuration files to match legitimate, pre-existing Apache modules such as mod_ssl or mod_suexec, so the malicious fi…”
- T1110Brute Force
“subfinder – takes root domains, resolvers, and a depth, then enumerates subdomains via DNS brute force, certificate transparency, and passive sources, returning the discovered subdomains.”
- T1213.003Code Repositories
“Autonomous agents mapped internal systems, mined code repositories, obtained root credentials from a secrets manager, and abused build pipelines and cloud resources, compressing activity that normally requires substantially more human effort.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Sekoia Honeypot Captures an Attack on GenAI Infrastructure“Earth Berberoka (alias GamblingPuppet): Documented by TrendAI3, this group of Chinese origin specializes in targeting iGaming platforms, online casinos, and betting sites, relying on multiplatform malware families historically attributed to Chinese-speaking actors (PlugX, Gh0st R…”
-
7th September – Threat Intelligence Report“Its infrastructure spans multiple languages and shows links to Earth Berberoka.”
-
Gambling Goblin Turns Brazilian Government Sites Into SEO Weapons“Check Point Research (CPR) dubbed the group Gambling Goblin and assessed with medium-to-high confidence that it is connected to Earth Berberoka, a Chinese-speaking cluster documented by Trend Micro in 2022 as targeting gambling platforms serving Chinese-speaking users.”
-
Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon“We dubbed this group Gambling Goblin: a Chinese-speaking cybercrime cluster connected to a previously documented group, Earth Berberoka, that targeted gambling sites across Asia.”
Indicators in its reports
named in the reports above- playfootball[.]infoin 1 report
- gov[.]brin 1 report
- com[.]brin 1 report
- github[.]wikiin 1 report
- github[.]lain 1 report
- gitlab[.]betin 1 report
- 232ef6be134c2b7c…883947fdf017in 1 report
- 088d0742a667f1ac…ef594dddf815in 1 report
- 88544d36beb6dc62…e0c86313d1c0in 1 report
- 9d3085eac9a59a94…49389ae33cdbin 1 report
- 263c14e84398339b…f07a71eb8a31in 1 report
- 12af9d95c44e20a3…ccfb2d42120din 1 report
- 5af1bec4635e52da…f4a9e3d48611in 1 report
- e8bb763bd10e7272…b181a0adc052in 1 report
- fa7fc029ac13af2f…fb7c3c83288din 1 report
- c3c09fe219e10808…05fe03cda98fin 1 report
- 2567d6b42dac97a3…f5e9bb23ab91in 1 report
- 1829efbf7946e1a9…7b0c5e10020ain 1 report
- f025520d648c7799…8c6319404fcfin 1 report
- 5a11ed7931fb6358…262cc49f82e8in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.