Check Point Research said the campaign, active since mid-2025, uses malicious Apache modules installed on breached web servers to redirect visitors and search crawlers towards attacker-controlled gambling and sports-betting pages while retaining the legitimate website address in the browser.
The company has named the cluster Gambling Goblin and assessed with medium-to-high confidence that it is connected to Earth Berberoka, a Chinese-speaking threat group documented in 2022 for targeting online gambling platforms serving users and operators across Asia.
Researchers said the attribution rests on overlaps in malware, operator artefacts and network infrastructure. Gambling Goblin has deployed oRAT, a Go-based remote-access trojan previously associated with Earth Berberoka, alongside Chinese-language strings and custom tools found with malware linked to the earlier cluster.
The campaign exploits the reputation of compromised websites rather than simply replacing their visible content. Attackers use custom Apache modules to act as reverse proxies, allowing certain web requests to retrieve fraudulent pages from remote servers while appearing to originate from government domains.
Those modules also strip Content-Security-Policy headers and substitute permissive settings, enabling injected or externally hosted scripts to run with fewer restrictions. Check Point said this makes compromised servers effective covert gateways for content designed to manipulate search rankings and attract users searching for gambling applications.
The fraudulent pages imitate app platforms such as Google Play, Microsoft Store and Amazon. They use fabricated ratings, review counts and structured metadata resembling legitimate listings, while promoting online gambling and sports betting to users in Brazil.
Investigators found that links embedded in the operation pointed to dozens of Brazilian domains, most of them government sites ending in. gov. br. The affected institutions were spread across federal, state and municipal levels and included a government ministry, a national public agency, a state legislative assembly, state audit bodies, a state-owned utility and numerous municipal administrations.
A smaller number of commercial domains, including local news, health and business websites, were also identified as compromised. Check Point did not disclose the names of the affected government bodies, limiting the risk of further exploitation while remediation takes place.
The attackers appear to be using the authority and search reputation of public-sector domains to push their own pages higher in search results. This form of abuse can give fraudulent content an advantage over criminal domains, which generally lack the trust and history of official websites.
Check Point said it had not directly observed how Gambling Goblin initially gained access to the servers. However, researchers found an exposed directory containing a Go-based reconnaissance tool described by the operators as a cluster asset mapping agent, designed to catalogue internet-facing systems and potential entry points.
Once access is established, the group can deploy a heavily obfuscated Linux toolkit that includes the DownPro downloader, AlphaAgent and oRAT backdoors, a credential stealer based on 3snake, an SSH brute-forcing utility and reconnaissance components. The tools use packing and virtualisation techniques intended to complicate analysis and detection.
oRAT provides remote control of infected Linux hosts, including command execution, file transfers, port scanning, proxy functions and embedded SSH access. The malware can establish persistence through system services, disguise its process as legitimate SSH activity and suppress logging, according to the technical analysis.
The operation is not confined to Brazil. Researchers identified phishing infrastructure localised for Vietnamese, Spanish and English-speaking audiences, together with systems that generate new domains each day. Some domains also directed users towards Chinese-language gambling and adult-content sites.
Trend Micro’s 2022 examination of Earth Berberoka, also known as GamblingPuppet, described a multiplatform operation using malware against Windows, Linux and macOS systems. Its primary targets at the time were gambling websites serving Chinese-speaking audiences, although other organisations were also affected.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
