Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages
Check Point links Gambling Goblin, a Chinese-speaking cluster, to malicious Apache modules hijacking Brazilian government servers to promote betting sites.
Check Point Research tracks Gambling Goblin, a Chinese-speaking cluster, installing malicious Apache reverse-proxy modules on compromised Brazilian government and education web servers since mid-2025. The modules divert visitors to gambling and fake app-store pages while stripping the site's security headers, likely for large-scale SEO manipulation. The group's Linux arsenal includes DownPro, AlphaAgent, oRAT, a 3snake-based credential stealer, and SSH brute-forcing tools, and it is tied to Trend Micro's Earth Berberoka. Related SEO-fraud campaigns on .gov.br domains were documented by ESET (GhostRedirector), Palo Alto Networks Unit 42, and Hunt.io.
- Malicious Apache modules reverse-proxy visitors from hijacked government domains to gambling and fake app-store pages.
- Linux toolset includes DownPro, AlphaAgent, oRAT, a 3snake credential stealer, and an SSH brute-forcer.
- ANY.RUN found at least 20 .gov.br portals serving as a delivery chain in the related PhantomEnigma campaign.
- Hunt.io found more than 630,000 URLs on hijacked gov.br subdomains serving keyword-stuffed pages to Googlebot.
- Cluster linked to Earth Berberoka, documented by Trend Micro in 2022 targeting gambling sites in Asia.
- Products
- Apache
- Threat actors
- Gambling GoblinEarth BerberokaGhostRedirector
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | registro.br | thorized operators to run on .bet.br domains issued through Registro.br, Brazil's domain registry. Check Point did not say whether |
From the original article
3 min read at thehackernews.com
A Chinese-speaking cybercrime cluster known as Gambling Goblin has been observed installing malicious Apache modules on compromised web servers run by Brazilian government and educational institutions, and using them to divert visitors to attacker-controlled pages promoting online gambling and sports betting. Check Point Research said it has tracked the campaign since mid-2025. The modules
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.