A Chinese-speaking cybercrime group that Check Point Research calls Gambling Goblin has been planting malicious Apache modules on web servers run by Brazilian government and educational institutions. The modules send visitors to pages that push online gambling and sports betting, The Hacker News reported. Check Point has tracked the campaign since mid-2025.
The modules work as reverse proxies, so traffic to the attacker’s pages still appears to come from the legitimate government domain. They also strip the site’s own security headers, which lets the injected content run freely. The pages pose as trusted app stores, including Google Play, Microsoft Store and Amazon, and use that cover to promote betting.
Check Point said the likely goal is SEO manipulation at scale: compromised high-reputation domains, many of them Brazilian government sites, are chained together to inflate search rankings. Because the pages already look like app-download sites, Check Point said the operators sit “one step from pushing malware straight to victims.” It also found parallel phishing networks in Vietnamese, Spanish and English, plus infrastructure that generates new domains every day.
The toolkit
Once on a server, the group deploys:
- DownPro, a custom downloader
- AlphaAgent, a modular backdoor
- oRAT, a remote access trojan
- A credential stealer based on 3snake, which attaches to newly spawned sshd and sudo processes to capture passwords
- An SSH brute-forcer
- A plugin-driven reconnaissance agent
Check Point said it hasn’t directly seen how the group gets initial access. It tied the cluster to Earth Berberoka, an actor Trend Micro documented in 2022 targeting gambling websites across Asia. Trend Micro also documented oRAT that year.
What has been published so far gives defenders little to act on. There’s no count of compromised servers, no affected organizations are named, and there are no module filenames, paths or hashes that administrators could check against their own Apache installs. Check Point also didn’t say whether the promoted betting sites are licensed. Brazil began licensing fixed-odds betting on Jan. 1, 2025.
A familiar playbook
Using compromised servers to boost gambling sites in search has come up before. ESET found at least 65 Windows servers, mostly in Brazil, Thailand and Vietnam, compromised in June 2025 by an actor it calls GhostRedirector. That group installed a malicious IIS module, Gamshen, which changed responses only for Googlebot. In July 2025, Hunt.io reported more than 630,000 URLs generated on hijacked gov.br subdomains that served keyword-stuffed pages to Googlebot and sent real users to betting sites.
For administrators of Linux web servers, the practical step is to audit which modules Apache loads. Compare the LoadModule lines and the module directory against a known-good baseline, and check for response headers that have gone missing.
WebProNews is an iEntry Publication