Gambling Goblin Targeting Brazil via Reputable SEO Hijacking

Since mid-2025, Check Point Research has tracked a Chinese-speaking cybercrime cluster, dubbed Gambling Goblin, targeting Brazilian government and educational institutions. The actor, linked to Earth Berberoka, utilizes a sophisticated Linux-based toolkit to compromise web servers and repurpose them for large-scale SEO manipulation. By hijacking high-reputation .gov.br domains, the attackers borrow institutional trust to redirect traffic toward localized gambling and sports betting phishing pages.

Technically, the operation involves the deployment of custom Apache modules that act as stealthy reverse proxies, stripping security headers (CSP) to allow injected malicious content to execute freely. The group uses a diverse arsenal including the AlphaAgent and oRAT backdoors, credential stealers, and scanners. The campaign's infrastructure is built to scale, with evidence of localized operations in Vietnam and other regions using automated domain generation to evade blocklists.

While currently focused on financial fraud through gambling traffic, the infrastructure represents a significant latent risk. The phishing pages already impersonate trusted platforms like Google Play and Microsoft Store, meaning the actor is one configuration change away from delivering direct malware payloads to unsuspecting visitors of official government websites.