Do Son 
Infection chain | Image: Check Point Research
At a Glance
| Actor or group | Suspected Gambling Goblin (linked to Earth Berberoka) |
| Activity type | SEO poisoning, reverse-proxy manipulation, credential theft |
| Targets or victims | Brazilian federal, state, and municipal government servers |
| Scale | Dozens of public-sector web portals and municipal domains |
| Jurisdiction or law-enforcement status | Active cybercrime threat; no arrests announced |
| Sources | Check Point Research, Trend Micro |
TL;DR
Security researchers discovered a wide cybercrime campaign by an actor dubbed Gambling Goblin. The group compromises Brazilian public-sector web servers and installs malicious Apache proxy modules. Consequently, the attackers abuse official government domain reputation to manipulate search rankings for illicit gambling networks.
What Happened
Scanning and Initial Access
Check Point Research recently exposed an active cybercrime operation compromising Brazilian public infrastructure. The attack cycle begins with automated network reconnaissance against exposed servers. Specifically, the attackers deploy an asset-mapping tool named cam-agent. This Go-based tool bundles open-source network scanners like httpx, nuclei, and naabu. Once the tool discovers an unpatched web server, the operators breach the system.
Rogue Apache Modules
Next, the intruders install custom Apache modules directly on the victim machine. An automated Bash script identifies the Linux distribution and compiles the malicious module using local tools. The script immediately deletes build artifacts and alters file timestamps to blend with legitimate system files.
The primary module intercepts incoming web requests matching specific prefixes such as /wps or /card. Then, it silently relays visitors to attacker-controlled infrastructure. The module strips the server’s Content-Security-Policy headers. In their investigation of the Brazilian government SEO campaign, Check Point Research detailed this mechanism. The researchers observed that the module routes traffic “while the traffic still appears to originate from the legitimate domain, with the site’s own security headers stripped so injected content runs freely.”
SEO Manipulation and Phishing Pages
After altering the web server, the attackers present deceptive landing pages to visitors. These pages mimic popular application stores like Google Play, the Microsoft Store, and Amazon. The report stated, “The phishing pages pose as trusted app stores such as Google Play, Microsoft Store, and Amazon.”
Behind this facade, the pages display Brazilian sports betting and lottery games. The operators build these landing pages in Brazilian Portuguese. They also inject fabricated user ratings and structured metadata to fool search crawlers. Because the links resolve on genuine .gov.br domains, search engines rank the scam pages near the top.
Custom Linux Malware Arsenal
Meanwhile, the operators deploy custom backdoors to secure persistent network access. They run a specialized Go downloader called DownPro to stage secondary payloads. DownPro drops a setuid root backdoor and installs an authentication credential harvester based on 3snake.
Additionally, the group deploys a modular backdoor named AlphaAgent. This implant disguises itself as legitimate system daemons and connects via encrypted gRPC channels. It can spawn interactive terminals, forward network traffic, and execute remote shell commands. The intruders also deploy ORAT, a remote access trojan that includes an embedded SSH server.
Who Is Behind It
Connections to Earth Berberoka
Check Point Research attributes this activity to the Gambling Goblin group with medium-to-high confidence. The team identified clear operational overlaps with Earth Berberoka, a Chinese-speaking threat group first documented by Trend Micro in 2022. Trend Micro previously tracked Earth Berberoka targeting gambling platforms throughout East Asia.
Shared Tooling and Artifacts
Several concrete technical links connect both groups. First, both operations utilize the identical ORAT backdoor codebase and REST API command structure. Second, AlphaAgent samples appeared inside file archives previously tied to Earth Berberoka.
Furthermore, the campaign features extensive Chinese-language artifacts. Analysts identified Chinese comments in Bash scripts, bilingual help flags in DownPro, and Chinese styling notes in website code. In addition, command infrastructure relies on hosting providers and ASNs historically used by Earth Berberoka.
Impact or Scale
Widespread Public Sector Exposure
The Gambling Goblin campaign has compromised dozens of prominent Brazilian institutions. At the federal level, victims include a national public agency and an executive ministry. At the state level, attackers breached legislative assemblies, courts of accounts, and state utilities.
However, local municipal governments represent the largest share of victims. Scores of city administration websites unknowingly host illegal betting links. A smaller number of local commercial and educational websites suffered similar compromises.
International Expansion and Latent Threats
Moreover, the threat extends far beyond South America. Researchers uncovered parallel phishing infrastructure localized in Vietnamese, Spanish, and English. The group uses automated domain generators to create fresh command infrastructure every single day.
Most concerning is the potential for immediate escalation. Because the fake pages already impersonate app stores, the operators could distribute malware instead of gambling ads with a single server configuration change.
What Comes Next or How Readers Can Stay Protected
Hardening Linux Web Servers
System administrators must inspect their web servers for unauthorized Apache modules. Review all loaded modules in configuration files and verify file integrity against official package managers. In addition, audit the filesystem for unexpected setuid binaries and rogue cron jobs.
Securing Access and Identity
Organizations should restrict administrative SSH access by enforcing multi-factor authentication. Never permit direct root SSH logins over public networks. Public-sector IT teams must patch exposed web applications promptly to prevent initial intrusion. Network defenders can discover active implants by hunting for anomalous outbound gRPC traffic and unusual systemd services.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
