DiceyF

Executive Summary

DiceyF is an advanced persistent threat group targeting online casinos and other entities in Southeast Asia, likely engaging in espionage and intellectual property theft. The group overlaps with known threat actors like LuckyStar PlugX and Earth Berberoka/GamblingPuppet, using evolving malware with encryption capabilities to remain stealthy.

Goals & Targeting

DiceyF's targeting of Southeast Asian online casinos and related sectors suggests an interest in acquiring sensitive data, such as customer information, operational strategies, or proprietary technologies. The group's emphasis on espionage and IP theft implies a strategic goal of gaining competitive advantages or conducting state-sponsored intelligence gathering. The focus on Southeast Asia may be driven by the region's growing digital economy and the presence of high-value targets within the gaming and financial sectors.

DiceyF has been actively targeting online casinos and other victims across Southeast Asia for an extended period. The group exhibits a high level of sophistication, regularly updating its malware codebase and integrating encryption to avoid detection. Cybersecurity vendors have observed overlap with the LuckyStar PlugX and Earth Berberoka/GamblingPuppet groups, suggesting potential shared infrastructure or tactics. While DiceyF's motivations are not explicitly clear, historical activity indicates a focus on espionage and intellectual property theft rather than direct financial gain. The group's operations emphasize stealth, suggesting a long-term strategic objective of data exfiltration and persistent access to compromised networks.

Key Capabilities

• Advanced encryption implementation in malware
• Stealthy cyberespionage operations
• Custom malware development and codebase evolution
• Persistence mechanisms for long-term access
• Targeted phishing campaigns against specific sectors

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

DiceyF's campaigns focus on Southeast Asian online casinos and related industries, utilizing techniques seen in associated groups such as LuckyStar PlugX. The group's operational tempo suggests sustained, long-term campaigns with a focus on stealth and encryption. Notable past activities include overlapping infrastructure use and continuous malware evolution, indicating a commitment to maintaining access and avoiding detection by security systems.

IOC Patterns

• Spear-phishing with macro-laced Office documents
• C2 over encrypted protocols (e.g., HTTPS, DNS)
• Staging infrastructure on bulletproof hosting services
• Custom payloads with obfuscated code

Recommended Actions

• Implement advanced phishing detection and employee training programs
• Monitor for anomalous network traffic indicative of encrypted C2 communications
• Deploy endpoint detection systems to identify custom malware behavior
• Conduct regular threat hunting exercises focused on Southeast Asian threat actor signatures
• Leverage threat intelligence feeds from vendors tracking DiceyF and associated groups

Suggested Tags