- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2022
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0292 · earth-berberoka
ChinaWhat it is
According to TrendMicro, Earth Berberoka is a threat group originating from China that mainly focuses on targeting gambling websites. This group's campaign uses multiple malware families that target the Windows, Linux, and macOS platforms that have been attributed to Chinese-speaking actors. Aside from using tried-and-tested malware families that have been upgraded, such as PlugX and Gh0st RAT, Earth Berberoka has also developed a brand-new complex, multistage malware family, which has been dubbed PuppetLoader.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- Gambling Puppet, GamblingPuppet
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- China, Hong Kong, Malaysia, Taiwan, United States
- Sectors
- Casinos and Gambling, Education, Electronics Manufacturers, Gambling Websites, Information technology
Tools
The tools and malware families the sources tie to it.
- AsyncRAT
- China Chopper
- Gh0st RAT
- PlugX
- PuppetLoader
- QuasarRAT
- Trochilus RAT
- Windows Remote Desktop
- gh0st
- oRAT
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de