Chinese Actor 'Gambling Goblin' Hijacks Brazilian Government Sites for SEO Fraud and Phishing
A Chinese-speaking cybercrime group, dubbed Gambling Goblin, is compromising Brazilian government and educational servers to host phishing pages that mimic app stores, pushing online gambling content and manipulating search engine results.
Check Point Research has uncovered a sustained cyber-espionage and fraud campaign targeting Brazilian organizations, primarily government and educational institutions, since mid-2025. The threat actor, identified as a Chinese-speaking group and named "Gambling Goblin," shows connections to a previously documented entity known as Earth Berberoka, which historically focused on gambling-related sites in Asia. This operation represents a significant shift, moving Brazil's typical threat landscape from local banking trojans to foreign actors actively compromising infrastructure.
The core of Gambling Goblin's operation involves repurposing compromised web servers into stealthy proxies. Attackers compile and install malicious Apache modules on these victim servers. These modules silently redirect visitors to attacker-controlled phishing pages, while the traffic still appears to originate from the legitimate, compromised domain. To facilitate this, the site's own security headers are stripped, allowing injected content to run without interference.
The phishing pages are designed to impersonate popular and trusted app stores, including Google Play, Microsoft Store, and Amazon. However, their true purpose is to lure unsuspecting users into online gambling and sports betting platforms. The group achieves large-scale reach by chaining together compromised high-reputation domains, many of which belong to Brazilian government entities. This tactic leverages the established trust and search engine ranking of these legitimate sites to inflate their own content's visibility and hijack organic traffic.
Once a server is compromised, Gambling Goblin deploys a comprehensive and heavily obfuscated Linux toolkit. This arsenal includes a custom downloader named "DownPro," multiple backdoors such as the modular "AlphaAgent" and the "oRAT" remote access trojan, a "3snake"-based credential stealer, an SSH brute-forcer, and a plugin-driven reconnaissance agent. A key characteristic of these tools is their extensive use of packing and virtualization layers, designed to significantly slow down analysis efforts and evade detection by security software.
Evidence suggests this operation is not confined to Brazil. Researchers have identified parallel phishing networks localized for Vietnamese, Spanish, and English-speaking audiences. Furthermore, the group utilizes infrastructure that generates new domains daily, indicating a model built for scalability and potential expansion into new geographical regions. This broad reach underscores the actor's ambition beyond a single target market.
The current scheme of SEO manipulation and phishing for gambling traffic carries a latent risk of escalation. Because the compromised infrastructure already mimics legitimate app-download destinations, it is a simple configuration change away from distributing malware directly to victims. This presents a significant potential threat beyond the current search-fraud and gambling-luring activities.
While the group's initial access methods remain unobserved, analysis of a compromised server revealed an exposed open directory containing an ELF binary written in Go. This "cam-agent" tool appears to be a sophisticated attack-surface-mapping pipeline for internet-facing targets, bundling numerous reconnaissance and scanning plugins. It communicates with its command-and-control server over gRPC, using embedded certificates for authentication, and leverages well-known open-source penetration testing tools like "dirprobe," "httpx," "naabu," "nuclei," "subfinder," and "whatweb" as modules.
This new report from Infosecurity Magazine details how the threat group Gambling Goblin is specifically leveraging compromised Brazilian government websites to conduct SEO fraud. The attackers are manipulating search engine results for gambling-related keywords, aiming to drive traffic to illicit gambling platforms by exploiting the authority of these government domains. This tactic allows them to bypass traditional security measures and reach a wider audience for their fraudulent operations.
This new report details the specific tools deployed by the Gambling Goblin threat cluster, including a custom downloader (DownPro), a modular backdoor (AlphaAgent), the oRAT trojan, a 3snake-based credential stealer, an SSH brute-forcer, and a reconnaissance agent. It also highlights that the group has been observed using a Go-written ELF binary for reconnaissance and scanning, and that parallel phishing networks localized in Vietnamese, Spanish, and English have been identified, along with infrastructure that generates new domains daily.
This new report details the specific technical mechanisms employed by the Gambling Goblin group, including the development and deployment of custom Apache modules compiled directly on compromised servers. These modules are designed to stealthily relay requests to attacker infrastructure, strip browser content-security restrictions, and selectively cloak content to manipulate search results, significantly enhancing the deception and evasion capabilities beyond what was previously understood.
The new reporting provides further technical details on the tactics employed by the "Gambling Goblin" group, including the specific use of Apache modules and Linux tools to construct a reverse-proxy network. It also highlights the potential for this infrastructure to be repurposed for malware distribution or deeper network compromise, beyond its current focus on SEO fraud for gambling sites. Furthermore, the analysis suggests a connection to the Chinese-speaking group Earth Berberoka, known for similar tactics in the Asia Pacific region, and notes the potential for AI-augmented development in the tools used.