Security Independently confirmed 3 publishers 2 min read Published Sep 2, 2026, 6:24 AM PDT

Gambling Goblin turns .gov.br servers into invisible reverse proxies for app-store phishing

Check Point says a Chinese-speaking crew has been running custom Apache modules on compromised Brazilian federal, state and municipal web servers since mid-2025, so the address bar and the TLD tell a visitor nothing useful.

The Watch · Security desk

Send a correction

Illustration accompanying Gambling Goblin turns .gov.br servers into invisible reverse proxies for app-store phishing — Generated illustration

What happened

Check Point Research says it has tracked a sustained campaign since mid-2025 by a Chinese-speaking cluster it calls Gambling Goblin, which compromises trusted government web servers.
The crew installs custom Apache modules that silently proxy visitors from the compromised server to attacker-controlled phishing pages, with no foreign domain ever appearing in the browser bar.
The compromised hosts include many .gov.br sites belonging to Brazilian federal, state and municipal institutions, according to Check Point.
The same modules strip the server's security headers, so scripts injected into the proxied pages run without Content-Security-Policy constraints.
The proxied pages impersonate Google Play, Microsoft Store and Amazon with fabricated ratings and structured metadata, and push online gambling and sports betting.

Why it matters

What it limits constraint Domain reputation and TLD allowlisting stop working here, because the abuse lives on selected paths of a genuine government host; useful filtering has to operate per-URL, which most enterprise policies do not.
Who's exposed exposure Every agency running a proxied host is also running backdoors, a credential stealer and a recon agent, so the exposure is not confined to the visitors who get redirected to a betting page.
What's now possible capability Fake app-store pages that already carry ratings and metadata become a malware distribution channel with a configuration change, per Check Point, and the delivery domain still reads as government.
What it sets up precedent With the template localised for three more language audiences and fresh domains generated daily, other national government TLDs become attractive inventory for the same borrowed-reputation model.

Next story · Security · yesterday

FortiManager flaw CVE-2024-47575 exposed configs and private keys for 500+ FortiGate firewalls

Confirmed5 publishers

The detection guidance says most of what you need to know about how hard this is to find. Check Point tells defenders to audit installed Apache modules for unexpected .so files, especially ones timestamped to match legitimate modules such as mod_ssl or mod_suexec ^[11]. Matched timestamps defeat the usual first pass, which is sorting the module directory by modification date. What is left is diffing the loaded module list against the package manager's manifest on every public web host, which is inventory work most public-sector estates have not done once, let alone continuously.

The second signal is path-scoped. CPR says a sudden absence of Content-Security-Policy headers on specific URL paths is a strong indicator of injected reverse-proxy behaviour ^[12]. Specific paths is the operative phrase. The root of the site keeps its headers and its real content, while a chosen path proxies attacker-controlled phishing pages with no foreign domain in the browser bar ^[4]. Reputation feeds, TLD allowlists and root-URL crawlers all evaluate the domain, and the domain is a real government domain, held by real federal, state and municipal institutions ^[3]. Blocking therefore has to be per-URL or not at all, and taking a state agency host offline in a web filter carries its own bill.

The borrowed trust runs further than the compromised hosts themselves. App tiles and navigation links on the phishing pages point to dozens of genuine domains, the majority of them impersonating legitimate .gov.br sites ^[16]. Search ranking is the product; the gambling and sports betting traffic is the revenue ^[6].

On portability, Check Point found the same template already localised for Vietnamese, Spanish and English-speaking audiences, with infrastructure generating fresh domains daily ^[9]. Counting Brazil's Portuguese deployment, that is four language markets running off one template ^[19].

Separate the attribution from the telemetry. The tie to Earth Berberoka, a cluster previously documented against Asian gambling sites, rests on infrastructure overlap that includes a shared Amazon ASN previously linked to that group, plus generated domains traced back to Chinese-language gambling and adult-content sites ^[8]^[18]. Check Point presents that as overlap. It is not a confession, and no host count is published: the writeup says "many" .gov.br sites and "dozens" of referenced domains ^[15].

The detail I would weight over the SEO fraud: alongside the proxy modules, the same intrusions deploy a Linux toolkit with several backdoors, a credential stealer and a reconnaissance agent for mapping internet-facing infrastructure ^[7]. The betting redirect is the part a visitor sees. Check Point also notes the pages already imitate Google Play, Microsoft Store and Amazon closely enough that one configuration change would serve apps instead of bets ^[10].

What to watch

Whether Brazilian authorities or Check Point publish a count of compromised .gov.br hosts, which the current writeup does not give.
The first observed swap on these proxy paths from betting redirects to actual app or APK delivery.
The same Apache module template appearing on government hosts outside Brazil, in the Vietnamese, Spanish or English-language versions.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence67
Adoption58
Hype gap+26
Incentives66
Confidence65

Perspective Coverage

3 publishers

Builder: Builder 23%
Operator: Operator 58%
Investor: Investor 19%

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
Check Point Research dubbed a Chinese-speaking cybercrime cluster "Gambling Goblin", which compromises trusted government websites and turns them into infrastructure for a fraud operation built to scale.
Reported SupportedView cited source
[2]
Check Point Research has been tracking the campaign as sustained and active since mid-2025.
Reported SupportedView cited source
[3]
The group compromises legitimate Brazilian government web servers, many of them .gov.br sites spanning federal, state and municipal institutions.
Reported SupportedView cited source
[4]
The group installs custom Apache modules on compromised servers that quietly proxy visitors to attacker-controlled phishing pages without ever showing a foreign domain in the browser bar.
Reported SupportedView cited source
[5]
The malicious Apache modules also strip the server's security headers, clearing the way for injected scripts to run unrestricted.
Reported SupportedView cited source
[6]
The phishing pages impersonate Google Play, Microsoft Store and Amazon, complete with fabricated ratings and structured metadata, while actually pushing online gambling and sports betting.
Reported SupportedView cited source
[7]
Once inside a host, Gambling Goblin deploys a broad, heavily obfuscated Linux toolkit: a custom downloader, several backdoors, a credential stealer and a reconnaissance agent for mapping internet-facing infrastructure.
Reported SupportedView cited source
[8]
Check Point links the group to Earth Berberoka, a previously documented cluster that targeted gambling sites across Asia, and found infrastructure overlaps including a shared Amazon ASN previously tied to Earth Berberoka.
Reported SupportedView cited source
[9]
Check Point Research found the same template already localised for Vietnamese, Spanish and English-speaking audiences, with infrastructure generating fresh domains daily.
Reported SupportedView cited source
[10]
Check Point says that because the phishing pages already impersonate legitimate app stores, the same infrastructure is one configuration change away from pushing malicious apps directly to victims.
Reported SupportedView cited source
[11]
Check Point advises defenders to audit Apache configurations and installed modules for unexpected .so files, especially any timestamped to match legitimate modules such as mod_ssl or mod_suexec.
Reported SupportedView cited source
[12]
Check Point says a sudden absence of Content-Security-Policy headers on specific URL paths is a strong signal of injected reverse-proxy behaviour.
Reported SupportedView cited source
[13]
Check Point says public-sector organisations should treat domain reputation as an asset to defend, because a compromised .gov domain can be weaponised to launder trust beyond its own users.
Reported SupportedView cited source
[14]
Check Point describes the Brazilian activity as a shift from the home-grown banking-trojan crews that have historically dominated the region.
Reported SupportedView cited source
[15]
Check Point's published findings describe "many" affected .gov.br sites and "dozens" of real domains referenced by the phishing pages, without stating a total count of compromised hosts.
Reported SupportedView cited source
[16]
In Brazil, app tiles and navigation links on the phishing pages point to dozens of real domains, the majority of examples found impersonating legitimate .gov.br government sites across federal, state and municipal institutions.
Reported SupportedView cited source
[17]
Check Point characterises the campaign as patient, industrialised abuse of institutional trust carried out with tooling more commonly associated with espionage-grade operations, blurring the line between cybercrime and APT.
Reported SupportedView cited source
[18]
Investigators traced generated domains back to gambling and adult-content sites aimed at Chinese-speaking audiences.
Reported SupportedView cited source
[19]
The template covers at least four language markets: Portuguese via the Brazilian deployment plus the Vietnamese, Spanish and English localisations Check Point found.
Derived Supported

Sources

3 independent publishers whose own reporting we read for this story.

blog.checkpoint.com
1 article · September 2, 2026
Gambling Goblin: A Chinese-Speaking Actor Hijacks Brazilian Government Sites to Fuel a Global SEO Fraud Machine
infosecurity-magazine.com
1 article · September 2, 2026
Gambling Goblin Turns Brazilian Government Sites Into SEO Weapons
thehackernews.com
1 article · September 2, 2026
Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder23%

The uncomfortable lesson for anyone shipping a public web property: the browser bar and the top-level domain certify nothing. A loadable Apache module compiled on the victim host, source deleted, timestamp filed to match mod_ssl, can serve fake Google Play tiles under a ministry's own hostname — and, as Infosecurity Magazine details, replace Content-Security-Policy with something permissive enough to let injected scripts run. Check Point tells you to look for unexpected .so files; The Hacker News points out no filenames or hashes were published to look for. That gap is the builder's real takeaway: module inventory and header assertions have to be things your build and monitoring own, because the indicator feed will not arrive in time.

Operator58%

This is a hunting story with the arithmetic missing. Check Point's guidance is concrete — audit modules, watch for CSP disappearing on specific paths, chase masqueraded processes rather than endpoint malware — and Infosecurity extends it to SSH configuration. But nobody publishes a host count, a victim name, or a statement that anything has been cleaned, and Check Point concedes it never saw how initial access happened. The Hacker News adds the operational nuance that matters most for anyone writing blocklists: ANY.RUN's earlier work on hijacked .gov.br and .jus.br portals warned that these are delivery-chain hosts, not attacker infrastructure, and blunt blocking takes citizen services offline with them.

Investor19%

Follow the money and the timing lines up. Brazil started licensing fixed-odds betting on 1 January 2025 and pushed authorised operators onto .bet.br, and by mid-2025 a foreign crew was harvesting government search reputation to funnel traffic to betting pages — a displacement of the local banking-trojan trade that both Check Point and Infosecurity flag. Nobody has priced it: there is no revenue estimate, no count of hijacked hosts, no word on whether the promoted operators hold Brazilian licences, a gap The Hacker News names explicitly. What is investable here is the direction of travel — templates already sitting in Vietnamese, Spanish and English, and a security vendor with an obvious interest in naming the crew that runs them.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence67: 0100
One vendor's findings, one outlet checking them
Every fact about Gambling Goblin itself originates with Check Point; the two trade reports are downstream of that single write-up. What lifts this above single-source reporting is that The Hacker News did verifiable work of its own — reading the 3snake source and matching oRAT to Trend Micro's 2022 Earth Berberoka research — and Infosecurity surfaced the confidence level and victim taxonomy the vendor summary skipped. What holds it back is that the mechanism is described but not evidenced: no hashes, no module paths, no observed initial access.
Adoption58: 0100
Technique demonstrably widespread, this campaign uncounted
The pattern is well attested outside Check Point: ESET counted 65 servers with a malicious IIS module, Unit 42 saw the same proxy trick on IIS, Hunt.io measured 630,000 URLs on hijacked gov.br subdomains, and ANY.RUN found at least 20 municipal and police portals in the delivery chain. Against that, Gambling Goblin's own footprint is described only as 'many' sites and 'dozens' of chained domains — real breadth, no measured depth.
Hype gap+26: −100 understated0 aligned+100 overstated
Framing runs ahead of the artifacts
'Espionage-grade', 'blurs the line between cybercrime and APT', 'one configuration change away from pushing malware' — the language is doing work the data does not yet support, on a campaign whose initial access vector Check Point admits it never observed. Notably, neither trade outlet picked up the APT framing, and The Hacker News instead published a list of what the report lacks. The underlying technique is real and corroborated on other platforms, which is why the gap is a lean rather than a chasm.
Incentives66: 0100
Naming rights are the product
The origin post is marketing collateral as much as research: a vendor coins the group name, supplies the hunting checklist, and closes by sending readers to its full report for the indicators the summary withholds. That withholding is itself the tell — the artefacts an administrator needs sit behind the funnel. The trade coverage is disinterested by comparison, though it inherits the vendor's frame wholesale except where The Hacker News pushes back.
Confidence65: 0100
Firm on how, vague on how much
Three accounts agree closely on mechanism, tooling and geography, and the attribution carries an explicitly stated medium-to-high confidence — so the 'what happened' is dependable. Scale, remediation and whether the promoted betting operators are licensed in Brazil remain open, and all of it still rests on one investigating team's telemetry.

Topics and entities

Topics

Brazil's Online Betting Market
Chinese-Speaking Cybercrime Clusters
Web Server Module Abuse
SEO Fraud and Traffic Hijacking
Public-Sector Domain Security