Earth Berberoka
Earth Berberoka, also known as GamblingPuppet, is an adversarial collective referenced in reporting as having deployed the Linux backdoor Xnote in attacks targeting online gambling sites. Supporting content also describes a broader, years-long campaign attributed by Palo Alto Networks Unit 42 to cluster CL-UNK-1068, assessed with moderate-to-high confidence to be primarily cyber espionage, targeting high-value organizations across South, Southeast, and East Asia in the aviation, energy, government, law enforcement, pharmaceutical, technology, and telecommunications sectors. The reported tradecraft spans Windows and Linux and includes exploitation of web servers to deploy web shells such as Godzilla and ANTSWORD, lateral movement, theft of IIS and web application files, browser data, office documents, and SQL backup files, and exfiltration by archiving data with WinRAR, Base64-encoding it with certutil, and printing the encoded output through a web shell. The toolkit described in the content includes Xnote, FRP for persistence, PrintSpoofer, the custom scanner ScanPortPlus, the .NET reconnaissance tool SuperDump, batch scripts for host discovery, and credential-theft tooling including Mimikatz, LsaRecorder, DumpItForLinux with Volatility, and SQL Server Management Studio Password Export Tool. The content directly links Earth Berberoka/GamblingPuppet to Xnote deployment against online gambling sites; broader attribution of the full CL-UNK-1068 activity to Earth Berberoka is not explicitly stated in the provided material.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Associated malware families
1 malware family attributed to this actor across reporting.
Recent activity
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.