A cybercrime group has been manipulating Apache modules on servers belonging to Brazilian government and educational domains to redirect real traffic toward fraudulent betting and gambling pages while cloaked in legitimacy. This scheme, traced since mid-2025, uses a reverse-proxy setup so that visitors believe they’re still on official Brazilian sites even when they’ve been stealthily pushed toward phishing content. Key security headers from the target sites are stripped, enabling this malicious content to run unchecked. Internal protocols and backdoors are exploited to maintain control over the compromised infrastructure. The actors behind this operation, identified as “Gambling Goblin,” are especially active in Brazil’s .gov.br and .jus.br domains.
What the Attackers Are Doing
These compromised Apache servers redirect visitors to phishing pages masquerading as app stores—Google Play, Microsoft Store, Amazon—while also pushing online gambling and sports betting offers under that facade. This traffic manipulation appears designed to improve search engine rankings (SEO) by using the high trust associated with government domains, with many of the compromised sites sprinkled throughout the Brazilian government and educational sectors.
Once they gain a foothold, the attackers deploy a toolkit including DownPro (a downloader), AlphaAgent (modular backdoor), oRAT (remote access trojan), a credential stealer based on “3snake,” an SSH brute-forcer, and a reconnaissance plugin framework. The “3snake” component in particular attaches to processes like sshd and sudo, pulling memory strings related to authentication credentials from rooted servers, giving the attackers admin-level access.
Related Campaigns and Wider Implications
Other reports connect Brazilian government infrastructure to similar SEO abuse. At least 20 portals belonging to municipalities and law enforcement had been used for malware distribution in a campaign dubbed PhantomEnigma. Experts note these compromised servers are part of the delivery chain—not necessarily the focal targets. Brazil’s law licensing fixed-odds betting, which took effect in January 2025, only authorizes operators under specific .bet.br domains, but it’s unclear whether the sites promoted via these attacks are licensed.
There are parallel networks serving localized phishing pages in Spanish, English, and Vietnamese, with daily domain generation and app-store style decoys on the front line. These networks are dangerously close to delivering outright malware. The group’s footprint overlaps with Earth Berberoka, a cluster previously seen pushing gambling malware across Asia. Some tools—oRAT, for example—were documented in earlier Earth Berberoka attacks. Separately, GhostRedirector used a similar IIS module called Gamshen to redirect Googlebot for SEO fraud while serving legitimate content to regular visitors. Partners investigating Brazil’s compromised servers have redacted sensitive indicators as local incident response teams monitor the situation.
Authorities have not confirmed how the attackers initially gained access to these servers. One exposed directory revealed an ELF binary built with Go that included network recon and plugin modules, hinting at reconnaissance or vulnerability scanning. The exact number of compromised hosts, module names, or file signatures remains undisclosed, complicating remediation efforts.
On a global scale, more than 630,000 URLs under hijacked Brazilian government subdomains were found generating SEO-stuffed content and redirecting actual users to betting sites. While no specific organizations have been named in public disclosure, government agencies have been notified. The cleanup status is not yet confirmed.
Why It Matters & What to Watch
This campaign leverages highly trusted domains to lend legitimacy to abuse, making it both deceptive and effective. Since search engines heavily favor government and institutional websites for SEO ranking, attackers gain disproportionate impact by using them to promote unauthorized content. Government sites must assume this risk not only to protect their reputations but to prevent broader phishing and malware exposure.
Defenses should include monitoring loaded Apache modules, enforcing security header integrity, and employing intrusion detection focused on unusual reverse-proxy behavior. Steps to audit module files, confirm cryptographic signatures, and validate all changes to webserver configuration are essential. Brazilian governmental bodies and registries should also verify which gambling domains are officially licensed.
Analytical perspective: this isn’t just technical trickery—it’s a sophisticated abuse of reputation and trust. Attackers are using institutional credibility as a weapon to push gambling, phishing, and possible malware at scale. A new dimension of cybercrime combines SEO fraud, phishing infrastructure, and reverse-proxy hijacks to monetize trust. Stakeholders worldwide — especially public institutions — must treat their web footprint as a core component of cybersecurity.
