Loading story…
Researchers reported that the newly identified APT group Earth Berberoka has targeted gambling websites using a mix of older tools and a cross-platform oRAT remote access trojan, including a macOS variant written in Go. The campaign used a fake Bitget application delivered as an unsigned disk image, with a package installer that relied on a preinstall script to drop and launch the malware from /tmp, indicating an effort to blend social engineering with lightweight macOS tradecraft.
Analysis of the macOS sample showed a UPX-packed Go binary with an encrypted configuration blob appended to the file and decrypted at runtime to recover command-and-control settings. The malware supports multiple communication modes, including TCP, STCP, and SUDP, and uses smux and QUIC for networking while beaconing to its C2 every five seconds. Once active, oRAT can transfer files, provide shell access, proxy traffic, scan ports, capture screenshots, and delete itself, underscoring a capable espionage toolset despite the comparatively unsophisticated delivery chain.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
SentinelOne published analysis of an unsigned macOS variant of the Go-based oRAT malware linked to the gambling-site targeting campaign. The report described delivery via a fake Bitget disk image and detailed the malware's installer, payload, configuration decryption, networking, and RAT capabilities.
Trend Micro reported a newly identified APT group, Earth Berberoka, targeting gambling websites and using both old and new malware in its operations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are using **compromised or spoofed websites** to trick victims into executing malware, with lures ranging from fake browser updates to counterfeit security-software download pages. Recorded Future’s Insikt Group reported that financially motivated **GrayCharlie** (overlapping with **SmartApeSG**) compromised multiple U.S. law-firm WordPress sites—potentially via a shared IT/marketing provider—and injected externally hosted JavaScript that redirected visitors to **bogus update pages** or **fake CAPTCHA** flows. Victims were prompted to run a PowerShell command via the Windows Run dialog, leading to **NetSupport RAT** installation and follow-on delivery of **Stealc** and **SectopRAT**; the operation’s infrastructure was noted as being supported by **MivoCloud** and **HZ Hosting Ltd.** Separately, Malwarebytes-linked reporting described a **typosquatting** campaign impersonating the Huorong antivirus site (`huoronga[.]com` vs. `huorong.cn`) to distribute **ValleyRAT** (built on the **Winos4.0** framework), attributed to the Chinese-speaking **Silver Fox APT**; the payload was routed through an intermediary domain and hosted on **Cloudflare R2**, with a ZIP masquerading as Huorong (`BR火绒445[.]zip`). In a different region and access vector, Group-IB reported Iran-linked **MuddyWater** running **Operation Olalampo** against MENA targets using **phishing emails** with malicious Office documents/macros to deploy new tooling including **GhostFetch** (dropping **GhostBackDoor**) and **CHAR** (a Rust backdoor controlled via a **Telegram bot**), plus variants using **HTTP_VIP** to deploy *AnyDesk*; the campaign also leveraged recently disclosed vulnerabilities on public-facing servers for initial access.
Jun 29, 2026
Recent reporting highlights multiple **social-engineering-driven malware delivery** efforts that culminate in remote access and persistent compromise. In South Korea, attackers distributed **counterfeit adult games** via popular “webhard” file-sharing services; victims received a ZIP containing a decoy `Game.exe` launcher that stages additional components (`Data1.Pak`, `Data2.Pak`, `Data3.Pak`) and ultimately injects **QuasarRAT** (aka **xRAT**), enabling host profiling, keylogging, and unauthorized file transfer. The execution chain included masqueraded artifacts such as `GoogleUpdate.exe` and `WinUpdate.db`, with AES used to decrypt/extract shellcode prior to privilege escalation and RAT injection. Separately, a spear-phishing campaign weaponized news about a purported **Nicolás Maduro arrest** to deliver a **backdoor**: emails carried a ZIP with a lure executable (`Maduro to be taken to New York.exe`) alongside a malicious DLL (`kuguo.dll`) that abuses a legitimate KuGuo binary for execution. Post-run behavior included replication to `C:\ProgramData\Technology360NB`, persistence via an auto-start renamed binary (`DataTechnology.exe`), and C2 beaconing for tasking and configuration updates; researchers noted tradecraft consistent with **Mustang Panda** but said attribution was not yet confirmed. A separate research note described **GravityRAT** reemerging as a multi-platform RAT with expanded **Android** targeting (in addition to Windows/macOS), emphasizing mobile endpoints as increasingly high-value targets for data theft and persistent access, though it did not describe the same specific campaigns as the Windows-focused lures above.
Jun 29, 2026
Attackers ran a large-scale cryptocurrency theft campaign built around **ElectroRAT**, a custom Golang remote access trojan hidden inside trojanized apps branded as **Jamm**, **eTrade**, and **DaoPoker**. The malware was distributed through dedicated websites, fake company fronts, forum accounts, social media personas, and paid promotion, targeting users on **Windows, Linux, and macOS**. Researchers said the operation had been active since at least January 2020 and likely reached thousands of victims, based in part on roughly **6,500 unique visitors** to Pastebin pages used to retrieve command-and-control details. Once installed, ElectroRAT ran covertly in the background as **`mdworker`** and gave operators broad surveillance and theft capabilities, including keylogging, screenshot capture, file upload and download, and remote command execution. The campaign’s infrastructure also showed ties to **Amadey** and the **KPOT** stealer, suggesting overlap with established criminal tooling, while the custom malware itself reportedly evaded antivirus detection for nearly a year. The operation highlights how convincing crypto-themed brands and cross-platform Electron applications were used to lure investors into installing malware that enabled wallet compromise and broader system access.
Aug 15, 2026