Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon
Check Point identifies Chinese-speaking group Gambling Goblin hijacking Brazilian government domains via malicious Apache modules for SEO-manipulated gambling phishing.
Check Point Research tracks a sustained campaign since mid-2025 against Brazilian government and educational organizations by Gambling Goblin, a Chinese-speaking cybercrime cluster linked to Earth Berberoka. Attackers compile and install malicious Apache modules that silently reverse-proxy visitors to phishing pages impersonating Google Play, Microsoft Store, and Amazon, chaining compromised high-reputation domains to inflate search rankings. The group deploys a heavily obfuscated Linux toolkit including DownPro, AlphaAgent, oRAT, a 3snake-based credential stealer, and SSH brute-forcers, with parallel phishing networks localized for Vietnamese, Spanish, and English victims.
- Compromised servers run stealthy reverse proxies with security headers stripped so injected content runs freely.
- Toolkit includes cam-agent, a Go-based reconnaissance agent using httpx, nuclei, naabu, and subfinder modules.
- Phishing pages sit one configuration change away from direct malware delivery, a latent escalation risk.
- Parallel networks with daily fresh domains indicate a scaling model built for export to new regions.
- Vendors
- Check Point
- Products
- Apache
- Threat actors
- Gambling GoblinEarth Berberoka
- Malware
- AlphaAgentoRATDownPro
- Organizations
- Gambling GoblinEarth BerberokaCheck Point Research
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | playfootball.info | d by the second Apache module brought us to a domain called playfootball[.]info that has a phishing page similar to the earlier ones. Unl |
From the original article
13 min read at research.checkpoint.com
Research by: Amit Yardeni Key Points Introduction Since mid-2025, Check Point Research has tracked a sustained campaign against Brazilian organizations. The tradecraft points to a Chinese-speaking cybercrime group connected to Earth Berberoka, an actor first documented targeting gambling sites across Asia. Once inside a victim, the group deploys a broad Linux toolkit: a custom downloader, several backdoors, […]
By stcpresearch · research.checkpoint.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.