Cybercrime Outfit Exploits Brazilian Government Websites for SEO Fraud
In a significant security breach, a Chinese-speaking cybercrime group has targeted compromised Brazilian government and educational websites to facilitate a persistent search engine optimization (SEO) fraud campaign. The malicious activities attributed to this group have been ongoing since mid-2025 and have raised alarm among cybersecurity experts and governmental authorities alike.
Check Point Research (CPR) has identified this cybercrime collective as "Gambling Goblin," drawing connections to an earlier group known as Earth Berberoka. This earlier entity had been documented by Trend Micro in 2022 for its focus on gambling platforms that catered specifically to Chinese-speaking users. The overlap between these two groups suggests a continuity of operations aimed at capitalizing on burgeoning online gambling markets.
A detailed analysis published by CPR on September 2 revealed various overlaps between the two entities, including similar tools, operator artifacts, and infrastructure usage. Notably, the research highlighted the attackers’ use of the remote access tool called oRAT, alongside Chinese-language scripts and domains that mimic trusted technology brands. Such tactics aimed to lend an air of legitimacy to the deceptive activities, thereby increasing the likelihood of unsuspecting visitors falling prey to the scams.
Shift in Cybercrime Tactics
CPR’s report illustrated a notable shift in the type of cybercrime emanating from Brazil. The focus has transitioned from home-grown banking trojans—a staple of local cyber threats—to operations controlled by foreign actors capitalizing on Brazil’s burgeoning online betting landscape. This change underscores the escalating stakes in the global cybercrime arena, making Brazilian online spaces particularly vulnerable.
One of the primary methods utilized by these cybercriminals involved the installation of custom Apache modules on the compromised websites. These malicious modules function as reverse proxies, unobtrusively directing selected visitors to phishing pages controlled by the attackers. According to CPR, the modules were programmed to target specific URL paths and were capable of stripping existing Content-Security-Policy headers. By replacing these with more permissive settings, they created openings for external and dynamically generated scripts to execute on the compromised sites.
Once installed, each module was compiled directly on the victim server, after which the source was deleted and the output file "timestomped" to appear as a legitimate Apache module. This sophisticated method made detection by website administrators significantly more difficult.
Localized Phishing Pages Targeting Brazilian Users
The phishing pages set up by the attackers sought to impersonate well-known destinations such as Google Play, the Microsoft Store, and Amazon. They were specifically tailored for Brazilian users, promoting online gambling and sports betting—a significant draw, given the country’s rapidly growing market in these sectors.
The breadth of impacted organizations is alarming, encompassing federal, state, and municipal government bodies—including ministries, national public agencies, legislative assemblies, and even state-owned utilities. Municipal administrations constituted the largest segment affected, highlighting the extensive reach of this campaign. Furthermore, several commercial Brazilian websites, including local news agencies, healthcare providers, and business associations, were also caught in this web of deceit.
Extensive Malicious Toolkit at Play
Beyond the immediate web-server activity, the fraudulent infrastructure was supported by a broader Linux malware toolkit. This toolkit reportedly included a myriad of malicious tools such as the DownPro downloader, backdoors like AlphaAgent and oRAT, and a credential stealer known as PasswordHarvester, which was based on the 3snake framework. These tools were bundled with packing and virtualization layers designed to hinder analysis and detection efforts.
Researchers at CPR also discovered reconnaissance agents utilizing tools like httpx, naabu, Nuclei, and subfinder, aimed at mapping internet-facing infrastructure and identifying vulnerable services running on potential targets. The capabilities of the malware were extensive, with AlphaAgent supporting remote command execution, file transfers, tunneling, and host discovery. Remarkably, a newer build was found to contain an execution path for an AI plugin, although its specific function remains undisclosed.
The infrastructure erected by the Gambling Goblin group extends beyond Brazil’s borders, featuring phishing pages localized in languages such as Vietnamese, Spanish, and English, along with systems designed to generate fresh domains on a daily basis. This broadening of scope not only heightens the potential impact of their cybercriminal activities but also raises global security concerns.
Urgent Security Recommendations
In light of these findings, researchers have issued stark warnings about the consequences of such operations. The setup presents a potential pathway for direct malware distribution, leveraging phishing infrastructures that already imitate legitimate app stores. CPR has advised organizations to conduct thorough audits of their Apache and SSH configurations, actively hunting for any rogue modules and processes masquerading as legitimate server activities.
The escalation of cybercrime tactics demonstrated by the Gambling Goblin group serves as a reminder of the ever-evolving landscape of cyber threats, further emphasizing the need for robust cybersecurity measures in protecting sensitive digital infrastructures.