Full Report
Research by: Amit Yardeni Key Points Introduction Since mid-2025, Check Point Research has tracked a sustained campaign against Brazilian organizations. The tradecraft points to a Chinese-speaking cybercrime group connected to Earth Berberoka, an actor first documented targeting gambling sites across Asia. Once inside a victim, the group deploys a broad Linux toolkit: a custom downloader, several backdoors, […] The post Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon appeared first on Check Point Research.
Analysis Summary
# Threat Actor: Gambling Goblin
## Attribution & Identity
* **Actor Name:** Gambling Goblin
* **Language/Origin:** Chinese-speaking cybercrime cluster.
* **Known Associations:** Closely connected to **Earth Berberoka** (an APT/cybercrime group previously documented by Trend Micro).
* **Identity Notes:** This actor represents a shift in the Brazilian threat landscape, moving from local banking-trojan operators to sophisticated foreign groups.
## Activity Summary
Since mid-2025, Check Point Research has tracked a sustained campaign by Gambling Goblin targeting Brazilian organizations. The actor compromises web servers (primarily Linux) to facilitate large-scale Search Engine Optimization (SEO) manipulation. By hijacking high-reputation domains—specifically government and educational sites—the actor redirects traffic to fraudulent gambling and sports betting platforms. The campaign also features parallel operations targeting Vietnamese, Spanish, and English-speaking users.
## Tactics, Techniques & Procedures
* **Stealth Proxying:** Compiling and installing custom Apache modules on compromised servers to reverse-proxy visitors to phishing pages.
* **Header Manipulation:** Stripping security headers from legitimate sites to allow injected malicious content to run without browser interference.
* **Obfuscation:** Extensive use of layered virtualization and packing to protect their Linux toolkit from analysis.
* **Credential Harvesting:** Brute-forcing SSH services to gain initial access or move laterally.
* **SEO Hijacking:** Chaining compromised high-authority domains to inflate the search engine rankings of malicious gambling sites.
* **MITRE ATT&CK Techniques:**
* T1190 – Exploit Public-Facing Application
* T1021.004 – Remote Services: SSH
* T1071.001 – Application Layer Protocol: Web Protocols
* T1584.004 – Compromise Infrastructure: Server
## Targeting
* **Sectors:** Government and Educational institutions are primary targets due to their high domain authority.
* **Geography:** Primarily **Brazil**, with secondary operations targeting **Vietnam**, and English/Spanish-speaking regions.
* **Victims:** Brazilian government websites and public sector web servers.
## Tools & Infrastructure
* **Malware Families:**
* **DownPro:** A custom downloader for initial stage delivery.
* **AlphaAgent:** A modular backdoor.
* **oRAT:** A remote access trojan (RAT).
* **3snake-based Stealer:** Used for credential theft.
* **SSH Brute-forcer:** For access and discovery.
* **Infrastructure:**
* **Domains:**
* kernel-lib[.]com
* js[.]ai-jquery[.]com
* api[.]onlinevrgame[.]com
* kerneltty[.]com
* 80[.]443[.]team
* up[.]443[.]team
* data[.]windows-update-cdn[.]com
* update[.]aliyun[.]la
* api[.]gitlab[.]bet
* **IP Addresses:**
* 154[.]84[.]62[.]160
* 15[.]228[.]251[.]82
* 43[.]198[.]248[.]193
* 165[.]22[.]101[.]200
* 202[.]146[.]222[.]18
## Implications
The actor has established a robust, scalable infrastructure for financial gain via gambling fraud. While the current focus is SEO manipulation and traffic redirection, the ability to mimic official app stores (Google Play, Microsoft Store) creates a **latent escalation risk**. A single configuration change could allow the actor to pivot from search fraud to large-scale malware distribution targeting the general public via trusted government domains.
## Mitigations
* **Integrity Monitoring:** Implement File Integrity Monitoring (FIM) for web server configurations and modules (specifically Apache/Nginx modules) to detect unauthorized changes.
* **Access Control:** Harden SSH access by disabling password authentication in favor of SSH keys and implementing IP whitelisting.
* **Log Analysis:** Audit web server logs for unusual outbound connections or proxy behavior originating from internal modules.
* **Vulnerability Management:** Prioritize patching of public-facing web applications to prevent initial compromise via exploits.