Chinese Threat Actor Is Quietly Hijacking Brazilian Government Websites to Rank Gambling Pages
A Chinese-speaking cybercrime group researchers are calling Gambling Goblin has been caught embedding malicious modules inside Apache web servers running on Brazilian government and university infrastructure. The payoff? Redirecting unsuspecting visitors to online gambling and sports betting pages while the address bar still shows a legitimate .gov.br domain.
Check Point Research has been tracking this since mid-2025, and the mechanics are fairly clever. The modules act as a reverse proxy, silently shipping traffic off to attacker-controlled pages. Security headers on the legitimate site get stripped so the injected content runs without interference. The destination pages impersonate Google Play, Microsoft Store, and Amazon to push gambling apps behind a veneer of legitimacy.
The primary objective appears to be SEO manipulation rather than data theft. High-trust government domains are valuable real estate in search engine rankings, and chaining enough of them together can artificially inflate a gambling site's visibility considerably. It is worth noting Brazil only began licensing fixed-odds betting on January 1, 2025, under Law 14,790/2023. Check Point did not confirm whether any of the promoted betting operations hold valid licences under that framework.
This is not an isolated incident. In July, ANY.RUN reported that at least 20 .gov.br portals belonging to Brazilian municipalities and police forces had been used to distribute malware in a campaign it calls PhantomEnigma. ANY.RUN was careful to distinguish these compromised government systems from attacker-controlled infrastructure, specifically warning against blanket blocking that would cut citizens off from public services.
Hunt.io found over 630,000 URLs generated across hijacked gov.br subdomains. The pages served keyword-stuffed government-style content to Googlebot while real users got bounced straight to betting sites. The company worked with Brazil's government incident response team, CTIR, and redacted certain indicators while that investigation remained active.
"The goal was not to break into systems. It was to control visibility," Hunt.io said. Quite.
Once inside a host, Gambling Goblin deploys a reasonably well-stocked toolkit. There is DownPro, a custom downloader; AlphaAgent, a modular backdoor; oRAT, a remote access trojan; a credential stealer based on the publicly available 3snake tool; an SSH brute-forcer; and a plugin-driven reconnaissance agent for mapping out compromised environments.
The 3snake component works by attaching ptrace to newly spawned sshd and sudo processes and pulling out password strings. In other words, credentials used to administer the compromised server get handed directly to the attackers. Check Point has not confirmed how initial access is achieved, though an exposed open directory on one of the group's servers contained a Go-compiled ELF binary bundling various scanning and reconnaissance plugins.
Check Point links this cluster to Earth Berberoka, a threat actor Trend Micro first documented in 2022 targeting gambling platforms across Asia using tooling attributed to Chinese-speaking operators. oRAT in particular has a clear paper trail back to that group. Xnote, a Linux backdoor associated with the same actor, appeared again in March during attacks on critical infrastructure across Asia.
This campaign also fits a broader pattern. ESET documented a separate but structurally similar operation in June 2025 where at least 65 Windows servers, mostly in Brazil, Thailand, and Vietnam, were compromised by a group it tracks as GhostRedirector. That actor installed a malicious IIS module called Gamshen which served manipulated responses exclusively to Googlebot, leaving normal visitors none the wiser. Palo Alto Networks Unit 42 documented the same reverse-proxy approach on IIS servers in September 2025.
So whether the underlying web server is Apache or IIS, a cluster of presumably China-aligned operators seems very interested in turning government and institutional web infrastructure into an invisible SEO network for the gambling industry.
Check Point's published report names no specific compromised organisations, includes no module filenames, paths, or hashes, and does not confirm whether any of the affected servers have been cleaned up. Administrators wanting to check what is loaded into their own Apache instances will need to wait for more actionable indicators. The phishing infrastructure meanwhile spans Vietnamese, Spanish, and English localised variants and generates new domains daily, which puts the operators, as Check Point notes, a single step away from pushing malware directly to visitors.