.jpg)
A Chinese-speaking cybercrime cluster has turned compromised Brazilian government and education websites into infrastructure for a sustained SEO fraud campaign operating since mid-2025.
Check Point Research (CPR) dubbed the group Gambling Goblin and assessed with medium-to-high confidence that it is connected to Earth Berberoka, a Chinese-speaking cluster documented by Trend Micro in 2022 as targeting gambling platforms serving Chinese-speaking users.
The research, published on September 2, said the overlaps covered tooling, operator artifacts and infrastructure, including the use of oRAT, Chinese-language strings and domains resembling trusted technology brands.
CPR described the campaign as a shift from Brazil's home-grown banking trojans to a foreign operator, drawn by one of the world's fastest-growing online betting markets.
Malicious Apache Modules Turn Trusted Sites into Proxies
The attackers installed custom Apache modules that acted as a reverse proxy, quietly routing selected visitors from compromised sites to attacker-controlled phishing pages.
CPR said the modules targeted specific URL paths and could strip existing Content-Security-Policy headers, replacing them with permissive settings that allowed external and dynamically generated scripts to run.
An installer compiled each module on the victim server, then deleted the source and timestomped the resulting file to match legitimate Apache modules.
The phishing pages impersonated destinations including Google Play, the Microsoft Store and Amazon. They were localized for Brazilian users and promoted online gambling and sports betting.
The compromised organizations spanned federal, state and municipal government, including a ministry, a national public agency, a state legislative assembly, courts of accounts and a state-owned utility. Municipal administrations made up the largest share.
The campaign also affected commercial Brazilian sites such as local news organizations, healthcare providers and business associations.
Read more on SEO fraud: Chinese-Speaking Cybercrime Group Hijacks IIS Servers for SEO Fraud
A Large Linux Toolkit Supports the Operation
The web-server activity sat alongside a broader Linux malware toolkit that CPR said included the DownPro downloader, backdoors including AlphaAgent and oRAT, the 3snake-based PasswordHarvester credential stealer and an SSH brute-forcer. Most were wrapped in packing and virtualization layers to slow analysis.
The researchers also found a reconnaissance agent that used tools such as httpx, naabu, Nuclei and subfinder, to map internet-facing infrastructure and identify services running on potential targets.
AlphaAgent supported remote command execution (RCE), file transfers, tunneling and host discovery, while oRAT provided remote administration. CPR identified an AI plugin execution path in a newer AlphaAgent build, although it said the sample did not reveal what the plugin did.
The infrastructure extended beyond Brazil. CPR found phishing pages localized in Vietnamese, Spanish and English, alongside systems generating fresh domains daily.
The researchers warned the setup created a potential path to direct malware distribution because the phishing infrastructure already imitated legitimate app stores. CPR advised auditing Apache and SSH configurations and hunting for rogue modules and masqueraded processes.
.jpeg)
