Loading malware…
cam-agent is a Go-based ELF reconnaissance utility used by the Chinese-speaking Gambling Goblin cybercrime cluster. It maps internet-facing infrastructure and identifies potential targets by bundling reconnaissance and scanning functionality, including web probing, port scanning, vulnerability scanning, subdomain discovery, and technology identification. It has been identified on exposed infrastructure associated with campaigns targeting Brazilian government and educational organizations. Gambling Goblin has been linked with medium-to-high confidence to the Earth Berberoka cluster.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Check Point researchers also identified a scanning component called cam-agent on exposed systems, which is used to gather information about internet-facing infrastructure and identify potential targets.”
“Researchers did not directly observe the initial break-in, but uncovered a scanning agent called cam-agent on exposed infrastructure. It uses reconnaissance tools to map internet-facing systems.”
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Researchers... uncovered a scanning agent called cam-agent on exposed infrastructure. It uses reconnaissance tools to map internet-facing systems.
“Check Point researchers also identified a scanning component called cam-agent on exposed systems, which is used to gather information about internet-facing infrastructure and identify potential targets.”
The agent uses dirprobe, httpx, nuclei, subfinder, and whatweb against internet-facing targets.
“[cam-agent] uses reconnaissance tools to map internet-facing systems. That can identify trusted web properties worth abusing.”
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.