Loading malware…
AlphaAgent is a modular Go-based Linux backdoor associated with the Chinese-speaking Gambling Goblin cybercrime cluster, which has been linked with medium-to-high confidence to Earth Berberoka. It has been deployed as post-compromise tooling against Brazilian government, educational, commercial, healthcare, and media web-server environments in a gambling-focused SEO-fraud and phishing operation active since mid-2025. AlphaAgent provides encrypted remote command execution, interactive shell access, file transfer, tunneling, proxying, and host discovery. It collects SSH keys and shell-history data, enabling credential access and follow-on movement through compromised environments. The malware supports encrypted gRPC-over-HTTPS communications, DNS tunneling, and an HTTP communication variant; it encrypts task data and can emulate browser network fingerprints and cloud-service themes to blend command-and-control traffic with legitimate activity. AlphaAgent also incorporates process and service-name masquerading, geofencing, sandbox-aware host inventory, and optional process hiding to reduce detection. Some builds contain an AI-plugin execution path, although its operational function has not been established.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Its toolkit includes DownPro, AlphaAgent, oRAT RAT, 3snake credential stealer, SSH brute-forcer, and reconnaissance tools.”
“AlphaAgent can run commands, move files, create tunnels, collect SSH keys and shell history, and hide under system-service names.”
20 distinct techniques documented for this family, organized by ATT&CK tactic.
AlphaAgent executes commands through /bin/sh -c, while oRAT passes operator input to sh -c.
AlphaAgent can install an embedded rootkit kernel module; other builds carry a component that hides processes and network connections at kernel level.
“Several tools use disguises, encryption, and memory-only unpacking.”
AlphaAgent can... hide under system-service names. oRAT can establish persistence through a service that mimics a legitimate firewall component.
“The malware can be disguised as a legitimate system service to reduce suspicion. oRAT similarly establishes persistence through a service designed to resemble a normal firewall-related component.”
AlphaAgent sets HISTFILE=/dev/null before executing remote shell commands.
AlphaAgent reports a virtualization role field so operators can identify virtual machines or sandboxes and abandon or delay activity.
AlphaAgent and oRAT bind-mount over their own /proc/<pid> entries; AlphaAgent can also hide processes and connections through a rootkit component.
“AlphaAgent ... [searches] for SSH keys and shell history.”
“AlphaAgent ... [searches] for SSH keys and shell history.”
AlphaAgent inventories active connections and interface addresses; info.sh gathers listening TCP ports and ARP neighbors.
AlphaAgent gathers users and login history; info.sh pulls recent login activity and examines every user's home directory.
AlphaAgent reports a virtualization role field so operators can identify virtual machines or sandboxes and abandon or delay activity.
AlphaAgent primarily uses gRPC over HTTPS; oRAT multiplexes HTTP requests over TCP, TLS/TCP, or QUIC/UDP sessions.
An AlphaAgent variant encrypts and Base32-encodes jobs, splits them across DNS labels, and exchanges them as TXT-style traffic on port 53.
AlphaAgent bundles a SOCKS5 proxy, yamux multiplexer, Ligolo-style relay, and a relay listener that forwards traffic upstream.
“After gaining access, the attackers can deploy additional tools through DownPro, a loader capable of retrieving payloads such as the ChUser backdoor, AlphaAgent and oRAT.”
“AlphaAgent supported remote command execution (RCE), file transfers, tunneling and host discovery, while oRAT provided remote administration.”
AlphaAgent bootstraps through public DoH providers such as Cloudflare and Google to resolve its server.
“AlphaAgent provides remote command execution, file transfers and tunneling capabilities.”
AlphaAgent encrypts configurations and job/result messages with AES-GCM beneath TLS; PasswordHarvester exfiltrates credentials RC4-encrypted and Base64-encoded.
89 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.