Exposing Earth Berberoka: A Multiplatform APT Campaign Targeting Online Gambling Sites

Backdoored ‘secret’ chat app

Earth Berberoka uses a backdoored chat app called MiMi. Based on its website, which is written in Chinese, MiMi is a “secret” chat app — “mì mì (密密)” means “secret” — that is available for both Windows and macOS. MiMi contains an embedded malware that is downloaded and run in the background upon launch of the MiMi chat app executable on a victim’s machine. It should be noted that although the chat app contains malware, we did not analyze the app itself as it appeared to be a legitimately functioning chat app.

Figure 2. The launched MiMi chat user interface shown while another executable with malware is running in the background

MiMi prompts new users to register with either a phone number or an email address. The choices of countries that the app supports are limited to the US, Canada, and a number of Asian countries, based on the phone number prefixes available in the registration drop-down menu. This supports our belief that gambling websites catering to Asian countries are the primary targets of Earth Berberoka’s campaign.

Figure 3. The MiMi chat app registration screen, with the mobile number registration field featuring a drop-down menu with mostly Asian phone number prefixes

Our analysis uncovered that the macOS version of MiMi loads two malicious executables that are both samples of the oRAT malware, while the Windows version loads a recent 64-bit version of the PlugX malware. We discuss the technical details of both malware families in relation to their use by Earth Berberoka in a blog entry.

Figure 4. Earth Berberoka’s infection chain via the MiMi chat app’s website

Fake cryptocurrency exchange app

Earth Berberoka also uses a fake BitGet app for macOS. BitGet is a Singapore-based cryptocurrency exchange platform.

The preinstall script of the fraudulent BitGet app downloads and executes the oRAT malware.

Figure 5. The preinstall script of the fake BitGet app

Fake website delivering backdoored Adobe Flash Player installer

Earth Berberoka exploits a persistent cross-site scripting (XSS) vulnerability in a legitimate website to execute JavaScript code hosted in a third-party server. The injected code calls a PHP script named xss.php, verifies that the victim is running Windows, and sets a cookie to ensure that the code will not be executed more than once. A pop-up with a message in Chinese then appears, stating that the version of Adobe Flash Player is too old to display the content, and redirects the victim to a website offering a supposedly updated version of Adobe Flash Player.

Our investigation yielded multiple websites that promise victims a free updated version of Adobe Flash Player but in fact tricks them into downloading malware. Although Adobe has not supported Flash Player since Dec. 31, 2020, and all major websites have disabled Flash plug-ins, we learned that Adobe allows a third-party editor to deliver a version of Flash Player in mainland China through the flash.cn website.

Figure 6. Earth Berberoka’s infection chain via a fake website offering a backdoored Adobe Flash Player installer

Consistent with the other fake websites connected to this campaign, this malicious Flash website is also written in Chinese, suggesting that Earth Berberoka primarily targets Chinese-speaking individuals.

Figure 7. A fake Chinese Adobe Flash Player website

According to our telemetry, Earth Berberoka has abused two websites for its infection chain involving its backdoored Adobe Flash Player installer. One is a news website aimed at the Chinese community of a large US city, and the other is an unknown website that was offline and had no domain name at the time of our investigation.