According to our telemetry, Earth Berberoka has abused two websites for its infection chain involving its backdoored Adobe Flash Player installer. One is a news website aimed at the Chinese community of a large US city, and the other is an unknown website that was offline and had no domain name at the time of our investigation.