Gambling Goblin Turns Brazilian Government Sites Into SEO Weapons
Check Point links Chinese-speaking cluster Gambling Goblin to SEO-fraud compromises of Brazilian government sites via malicious Apache modules since mid-2025.
Check Point Research dubbed the cluster Gambling Goblin and linked it with medium-to-high confidence to Earth Berberoka, a Chinese-speaking group Trend Micro documented in 2022, citing shared oRAT tooling, Chinese-language artifacts, and domains mimicking trusted tech brands. Custom Apache modules installed on compromised Brazilian government and education servers acted as reverse proxies, routing selected visitors to gambling and sports-betting phishing pages impersonating Google Play, the Microsoft Store, and Amazon while stripping CSP headers. The broader Linux toolkit included the DownPro downloader, AlphaAgent and oRAT backdoors, the 3snake-based PasswordHarvester credential stealer, and an SSH brute-forcer, with operations extending to Vietnamese, Spanish, and English phishing pages.
- Custom Apache modules acted as reverse proxies, sending selected visitors to attacker-controlled phishing pages.
- Modules stripped existing Content-Security-Policy headers and replaced them with permissive settings.
- Attribution links include oRAT use, Chinese-language strings, and domains resembling trusted technology brands.
- Toolkit included AlphaAgent backdoor with RCE, PasswordHarvester credential stealer, DownPro downloader, and SSH brute-forcer.
- Victims spanned federal, state, and municipal government, a state-owned utility, plus news and healthcare sites.
- Products
- Apache
- Threat actors
- Gambling GoblinEarth Berberoka
From the original article
2 min read at infosecurity-magazine.com
Gambling Goblin compromised Brazilian government sites to drive gambling traffic through SEO fraud
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.