- The Mess: A Chinese-speaking cybercrime group dubbed Gambling Goblin is hijacking Brazilian government and education servers and turning their trusted domains into covert SEO weapons. The attackers install malicious Apache modules that quietly proxy visitors to attacker-controlled gambling and phishing pages.
Check Point Research has tracked the campaign since mid-2025.
The victims aren’t random blogs.
They include municipal administrations, government institutions, educational organizations, a state legislative assembly, courts of accounts and a state-owned utility.
That makes the trick particularly effective.
The attacker doesn’t need a new domain with zero reputation.
They steal someone else’s.
Once a server is compromised, Gambling Goblin installs a custom Apache module compiled directly on the victim’s Linux machine.
The installer checks the Linux distribution, downloads Apache development packages, retrieves the malicious opsproxy.c source and compiles the module locally.
Then it loads the module into Apache and restarts the web server.
The attackers even clean up after themselves.
Source files and build artifacts are deleted. The resulting files are timestomped to resemble legitimate Apache modules such as mod_ssl or mod_suexec.
A quick administrator inspection can therefore miss the modification entirely.
- The Damage: Visitors searching the web can be silently redirected from trusted government domains to fake Google Play, Microsoft Store and Amazon pages that ultimately promote gambling and can be switched to malware delivery.
The malicious Apache module watches incoming requests for specific URL paths.
In the samples analyzed by Check Point, paths such as /wps, /bmw and /card trigger the redirection logic.
The server then reverse-proxies the request to infrastructure controlled by the attackers.
From the visitor’s perspective, the traffic still appears to come from the legitimate compromised domain.
That is the dirty trick.
The victim doesn’t necessarily see some obviously suspicious gambling domain.
They see a trusted website.
The attackers also strip Content-Security-Policy headers from the proxied content and replace them with a permissive policy.
That gives attacker-controlled JavaScript far more freedom to execute inside the browser.
And the gambling pages aren’t the only concern.
The operation already impersonates major software distribution brands.
Fake Google Play.
Fake Microsoft Store.
Fake Amazon.
Today the infrastructure pushes gambling.
Tomorrow the same page can deliver a malicious APK, Windows installer or browser payload.
Check Point explicitly warns that the operation is effectively one configuration change away from direct malware delivery.
The attackers also built a sizeable Linux toolkit around the operation.
It includes the DownPro downloader, AlphaAgent and oRAT backdoors, a credential stealer, SSH brute-forcing capabilities and reconnaissance tooling.
The reconnaissance agent can use tools such as httpx, naabu, nuclei, subfinder and WhatWeb to map potential targets.
In other words, the compromised government server isn’t just a website anymore.
It’s an attack platform.
The group can inventory hosted domains, identify web roots and determine where reverse-proxy rules can be inserted.
That lets the attackers choose which trusted domains are most useful for their SEO operation.
And the campaign isn’t staying inside Brazil.
Check Point found related phishing infrastructure targeting Vietnamese users, along with Spanish- and English-language pages.
The operators also maintain infrastructure capable of generating fresh domains every day.
That’s a pretty clear sign this isn’t somebody manually compromising a few websites for pocket money.
It’s an industrialized traffic-generation machine.
The attribution is also interesting.
Check Point assesses with medium-to-high confidence that Gambling Goblin is connected to Earth Berberoka, a Chinese-speaking group previously associated with gambling operations targeting Asian markets.
The overlap includes malware, infrastructure and operator artifacts.
- The Fix: Public-sector and Linux administrators should audit exposed servers, SSH access and Apache modules, remove unauthorized modules, hunt for masqueraded processes and rebuild compromised hosts rather than trusting a simple cleanup.
Administrators should inspect Apache’s loaded modules and configuration for anything that doesn’t belong.
Unexpected .so modules deserve immediate attention.
So do suspicious timestamps, unexplained reverse-proxy rules and new Apache configuration files.
SSH deserves equal scrutiny.
Check Point says the campaign relies on weak SSH credentials and exposed services rather than some spectacular zero-day.
That’s an important detail.
There is no exotic exploit required to turn a government domain into an attack platform.
An exposed server, weak credentials and insufficient monitoring can be enough.
Organizations should also review web-server logs for unusual URL paths and unexplained proxy behavior.
If a public website suddenly starts serving content that isn’t present in its document root, don’t treat it as an SEO problem.
Treat it as a compromise.
And if the machine has been fully controlled by the attacker, rebuild it.
Trying to surgically remove a malicious Apache module from a server containing backdoors and credential stealers is gambling with the integrity of the entire system.
Bugstoday Opinion
This is one of those attacks that looks stupid until you understand what the attacker actually stole.
They didn’t steal the government’s database.
They stole the government’s reputation.
A .gov.br domain already has something an attacker can’t easily buy: trust.
Search engines trust it.
Users trust it.
Browsers trust it.
Organizations trust it.
So Gambling Goblin turned that trust into an SEO weapon.
The malicious Apache module is almost secondary.
The real payload is the reputation of the compromised domain.
And that’s why this campaign matters outside Brazil.
Every organization running a public-facing Linux server should be asking the same question:
If someone owned this box tomorrow, what reputation could they weaponize?
A government website can sell gambling traffic.
A university can sell fake software.
A healthcare domain can distribute phishing.
A municipal website can become a malware landing page.
The server doesn’t have to contain valuable data.
Sometimes the domain itself is the asset.
The attackers didn’t build a trusted website. They stole one.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
Check Point Research — Gaming the System: How a Chinese-Speaking Actor Turned Brazilian Government Sites Into an SEO Weapon
The Hacker News — Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages
