Earth Berberoka Targets Gambling Sites With Cross-Platform oRAT Malware
Malware Intelligence · 2 sources · Updated 3mo ago · First seen May 9, 2022
Researchers reported that the newly identified APT group Earth Berberoka has targeted gambling websites using a mix of older tools and a cross-platform oRAT remote access trojan, including a macOS variant written in Go. The campaign used a fake Bitget application delivered as an unsigned disk image, with a package installer that relied on a preinstall script to drop and launch the malware from /tmp, indicating an effort to blend social engineering with lightweight macOS tradecraft.
Analysis of the macOS sample showed a UPX-packed Go binary with an encrypted configuration blob appended to the file and decrypted at runtime to recover command-and-control settings. The malware supports multiple communication modes, including TCP, STCP, and SUDP, and uses smux and QUIC for networking while beaconing to its C2 every five seconds. Once active, oRAT can transfer files, provide shell access, proxy traffic, scan ports, capture screenshots, and delete itself, underscoring a capable espionage toolset despite the comparatively unsophisticated delivery chain.
