Cybercriminals Hijack Brazilian Government Sites to Redirect to Gambling Pages
The Gambling Goblin group installs malicious modules on compromised servers to divert users to betting sites.
1Attack Scope
The Chinese-speaking cybercrime group Gambling Goblin has compromised web servers belonging to Brazilian government and educational institutions, installing malicious Apache modules. These modules redirect visitors to attacker-controlled online gambling and sports betting sites. Check Point Research has been tracking this campaign since mid-2025. Attackers proxy traffic to phishing pages while making it appear to originate from legitimate domains.
2SEO Manipulation
The likely goal is large-scale search engine ranking manipulation by chaining high-reputation domains, including Brazilian government sites. ANY.RUN's July report indicated at least 20 .gov.br portals were used to distribute malware in the PhantomEnigma campaign. However, these systems were part of the delivery chain, not direct targets. Blocking them broadly would disrupt access to government resources.
3Legal Loopholes
Brazil began licensing fixed-odds betting under Law 14,790/2023 on January 1, 2025, allowing operators to use .bet.br domains issued by Registro.br. Check Point did not confirm whether the promoted betting sites held this authorization. This highlights how legal gaps are exploited by criminals. The campaign leverages compromised high-trust domains to lend credibility to unauthorized gambling operations.
4Tools Used
Attackers deploy a tool called 3snake on compromised hosts, which attaches ptrace to new sshd and sudo processes to extract password authentication strings. The Hacker News reviewed 3snake's source code in September 2026 and verified these capabilities. Credentials used to administer hacked servers are thus readable by the operators. Initial access vectors remain unconfirmed, but exposed directories contained Go-written reconnaissance binaries.
5Parallel Campaigns
ESET documented at least 65 Windows servers (mainly in Brazil, Thailand, Vietnam) compromised in June 2025 by GhostRedirector, a China-aligned actor installing the Gamshen IIS module for SEO fraud. Gamshen only alters responses to Googlebot, leaving normal visitors unaffected. Palo Alto Networks observed identical reverse-proxy techniques on IIS servers in September 2025, showing method replication across web server technologies.
6Widespread Impact
Hunt.io found over 630,000 URLs generated on hijacked gov.br subdomains in July 2025, serving keyword-stuffed pages to search bots while redirecting users to betting sites. Brazil's CTIR incident response team collaborated to redact certain indicators during investigation. Hunt.io emphasized the operation aimed to 'control visibility' rather than breach systems, exploiting trusted domains to manipulate search rankings at scale.
7Historical Connections
Check Point linked this cluster to Earth Berberoka, an actor Trend Micro documented in 2022 targeting Asian gambling sites with malware families attributed to Chinese speakers. Xnote, a Linux backdoor tied to the group, appeared in March 2026 attacks on Asian critical infrastructure. Trend Micro's April 2022 report on Earth Berberoka also covered oRAT (version 0.5.1), a cross-platform tool in their arsenal, confirming longstanding operations.
8Implications
With infrastructure generating new domains daily and pages already mimicking app stores, attackers are 'one step from pushing malware straight to victims.' The published analysis names no affected organizations nor confirms server remediation. This incident demonstrates how government system vulnerabilities can enable transnational cybercrime. Organizations must strengthen visibility, response, and remediation strategies before AI-powered attacks accelerate the threat landscape further.