{
	"id": "1b55c8b3-4a8a-4cdf-8cc7-35f784249fe9",
	"created_at": "2026-04-06T00:10:34.158924Z",
	"updated_at": "2026-04-10T03:35:10.776361Z",
	"deleted_at": null,
	"sha1_hash": "b2a4a3232908e68da22b4be62411352de111ee6c",
	"title": "Earth Berberoka - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 48867,
	"plain_text": "Earth Berberoka - Threat Group Cards: A Threat Actor\r\nEncyclopedia\r\nArchived: 2026-04-05 14:42:54 UTC\r\nHome \u003e List all groups \u003e Earth Berberoka\r\n APT group: Earth Berberoka\r\nNames\r\nEarth Berberoka (Trend Micro)\r\nGamblingPuppet (Trend Micro)\r\nCountry China\r\nMotivation Information theft and espionage\r\nFirst seen 2022\r\nDescription\r\n(Trend Micro) We recently discovered a new advanced persistent threat (APT) group that we\r\nhave dubbed Earth Berberoka (aka GamblingPuppet). Based on our analysis, this group targets\r\ngambling websites. Our investigation has also uncovered that Earth Berberoka targets the\r\nWindows, Linux, and macOS platforms, and uses malware families that have been historically\r\nattributed to Chinese-speaking individuals.\r\nObserved\r\nSectors: Casinos and Gambling.\r\nCountries: Southeast Asia.\r\nTools used AsyncRAT, Gh0st RAT, oRAT, PlugX, PuppetLoader, QuasarRAT, Trochilus RAT.\r\nInformation\r\n\u003chttps://www.trendmicro.com/en_us/research/22/d/new-apt-group-earth-berberoka-targets-gambling-websites-with-old.html\u003e\r\nLast change to this card: 03 May 2022\r\nDownload this actor card in PDF or JSON format\r\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=8051fd82-774c-49ee-8efe-c1125acda67b\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=8051fd82-774c-49ee-8efe-c1125acda67b\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=8051fd82-774c-49ee-8efe-c1125acda67b"
	],
	"report_names": [
		"showcard.cgi?u=8051fd82-774c-49ee-8efe-c1125acda67b"
	],
	"threat_actors": [
		{
			"id": "452d2d74-e812-45d6-b0fe-b8a6cc4ebd01",
			"created_at": "2022-10-25T16:07:23.562676Z",
			"updated_at": "2026-04-10T02:00:04.662064Z",
			"deleted_at": null,
			"main_name": "Earth Berberoka",
			"aliases": [
				"GamblingPuppet"
			],
			"source_name": "ETDA:Earth Berberoka",
			"tools": [
				"Agent.dhwf",
				"AngryRebel",
				"AsyncRAT",
				"CinaRAT",
				"Destroy RAT",
				"DestroyRAT",
				"Farfli",
				"Gh0st RAT",
				"Ghost RAT",
				"Kaba",
				"Korplug",
				"Moudour",
				"Mydoor",
				"PCRat",
				"PlugX",
				"PuppetLoader",
				"Quasar RAT",
				"QuasarRAT",
				"RedDelta",
				"Sogu",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"Trochilus RAT",
				"Xamtrav",
				"Yggdrasil",
				"oRAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "2664d6f5-f918-4978-87f8-f6afad7402c6",
			"created_at": "2023-01-06T13:46:39.393669Z",
			"updated_at": "2026-04-10T02:00:03.312065Z",
			"deleted_at": null,
			"main_name": "Earth Berberoka",
			"aliases": [
				"GamblingPuppet"
			],
			"source_name": "MISPGALAXY:Earth Berberoka",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434234,
	"ts_updated_at": 1775792110,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/b2a4a3232908e68da22b4be62411352de111ee6c.pdf",
		"text": "https://archive.orkl.eu/b2a4a3232908e68da22b4be62411352de111ee6c.txt",
		"img": "https://archive.orkl.eu/b2a4a3232908e68da22b4be62411352de111ee6c.jpg"
	}
}