Full Report
A Chinese-speaking cybercrime cluster known as Gambling Goblin has been observed installing malicious Apache modules on compromised web servers run by Brazilian government and educational institutions, and using them to divert visitors to attacker-controlled pages promoting online gambling and sports betting. Check Point Research said it has tracked the campaign since mid-2025. The modules
Analysis Summary
# Morning News Roll-up September 02, 2026
## Overview
A Chinese-speaking cybercrime cluster, identified as "Gambling Goblin," is actively compromising web servers at Brazilian government and educational institutions. By installing malicious Apache modules, the actors hijack legitimate traffic to promote online gambling and sports betting, leveraging the high reputation of government domains to manipulate search engine rankings.
## Top Stories
### Gambling Goblin Targets Brazilian Government Servers via Malicious Apache Modules
- Summary: Threat actors are installing custom Apache modules on compromised servers to reverse-proxy visitors to gambling phishing pages. These modules strip security headers from legitimate sites, allowing injected content to pose as trusted app stores like Google Play to push betting apps.
- Source: hxxps://thehackernews[.]com/2026/09/malicious-apache-modules-hijack[.]html
### Earth Berberoka Links to Global Gambling Malware Campaigns
- Summary: The "Gambling Goblin" cluster has been linked to the Earth Berberoka group, which historically targets gambling sites across Asia. The campaign utilizes a sophisticated Linux-based arsenal including the oRAT and Xnote backdoors to maintain persistence and control over critical infrastructure.
- Source: hxxps://thehackernews[.]com/2026/09/malicious-apache-modules-hijack[.]html
### PhantomEnigma Campaign Hijacks .gov.br Portals
- Summary: Reports indicate at least 20 .gov.br portals, including municipal and police websites, have been integrated into a delivery chain for malware and gambling redirects. This campaign, tracked as PhantomEnigma, utilizes compromised high-reputation domains to inflate search engine rankings (SEO manipulation).
- Source: hxxps://thehackernews[.]com/2026/07/20-hijacked-government-websites[.]html
# Gambling Goblin Campaign (2025-2026)
## Key Points
- **SEO Weaponization:** Compromised high-reputation domains (government and educational) are chained together to inflate search engine rankings for gambling sites.
- **Traffic Hijacking:** Malicious Apache modules reverse-proxy visitors. The traffic appears to originate from the legitimate domain, effectively bypassing user suspicion.
- **Security Header Stripping:** The modules remove the original site's security headers, enabling the execution of injected scripts and malicious content.
- **Phishing Facades:** Injected pages mimic legitimate marketplaces like Google Play, Microsoft Store, and Amazon to build trust before pushing betting applications.
- **Potential for Escalation:** While currently focused on gambling, the infrastructure is capable of pushing direct malware payloads to victims at any time.
## Threat Actors
- **Gambling Goblin:** A Chinese-speaking cybercrime cluster active since mid-2025.
- **Earth Berberoka:** An APT group (linked to Gambling Goblin) known for targeting gambling entities in Asia.
- **Motivations:** Financial gain through online gambling/sports betting promotion and large-scale SEO manipulation.
## TTPs
- **Malicious Apache Modules:** Deployment of custom server-side modules to intercept and modify web traffic.
- **Credential Stealing:** Use of a **3snake-based** tool that attaches `ptrace` to `sshd` and `sudo` processes to capture plaintext passwords.
- **Reverse Proxying:** Redirecting legitimate requests to attacker-controlled phishing infrastructure.
- **Brute-Forcing:** Use of SSH brute-forcer tools for lateral movement or initial access.
- **Infrastructure:** Use of localized phishing networks (Vietnamese, Spanish, English) and daily generation of new domains.
## Affected Systems
- **Web Servers:** Primarily those running **Apache HTTP Server**.
- **Operating Systems:** Linux-based servers (targeted by ELF binaries and `3snake`).
- **Victims:** Brazilian government (.gov.br), judicial (.jus.br), and educational institutions.
- **Geographic Scope:** Primarily Brazil, with related activity in Thailand and Vietnam.
## Mitigations
- **Module Auditing:** Web administrators should regularly audit loaded Apache modules (`apachectl -M`) for unauthorized or suspicious entries.
- **Integrity Checking:** Verify the integrity of system binaries and web server configuration files.
- **Restricted Permissions:** Disable or restrict `ptrace` capabilities to prevent tools like `3snake` from hooking into sensitive processes.
- **SSH Hardening:** Disable password-based authentication in favor of SSH keys and implement rate-limiting or Fail2Ban to prevent brute-force attacks.
- **Header Monitoring:** Monitor for the unexpected removal or modification of security headers (e.g., CSP, HSTS) on public-facing sites.
## Conclusion
The Gambling Goblin campaign represents a sophisticated intersection of traditional cybercrime and advanced persistent threat (APT) techniques. By compromising high-trust government infrastructure, the actors gain a significant advantage in SEO rankings and user deception. Organizations in the targeted regions should conduct immediate audits of their web server modules and prioritize hardening SSH access to prevent the deployment of credential-stealing tools.
***
### IoCs (Defanged)
- **Malware Families:**
- DownPro (Downloader)
- AlphaAgent (Backdoor)
- oRAT (Remote Access Trojan)
- Xnote (Linux Backdoor)
- **Source Domains/Links:**
- hxxps://thehackernews[.]com/2026/09/malicious-apache-modules-hijack[.]html
- hxxps://research[.]checkpoint[.]com/2026/gaming-the-system-how-a-chinese-speaking-actor-turned-brazilian-government-sites-into-an-seo-weapon/
- hxxps://github[.]com/blendin/3snake (Public tool utilized by actor)