Gambling Goblin Hijacks Brazilian Government Servers via Malicious Apache Modules

A Chinese-speaking cybercrime group is compromising Brazilian government and educational web servers to redirect legitimate traffic toward fraudulent gambling platforms. The campaign leverages the inherent trust of public institutions to lure unsuspecting visitors into sports betting schemes.

According to Check Point Research, which has tracked the activity since mid-2025, the threat actor—dubbed "Gambling Goblin"—targets servers belonging to Brazilian government and educational entities. Once access is gained, the attackers install malicious Apache modules. These modules operate at the server level to hijack incoming traffic, seamlessly diverting users from official .gov.br and academic domains to illicit online gambling and sports betting pages.

The Strategy of Trust

By targeting high-trust domains, Gambling Goblin utilizes a psychological exploit known as authority bias. When a user visits a government or educational site, they typically assume the environment is secure and the content is legitimate. By hijacking these specific domains, the attackers lend an air of credibility to the fraudulent betting pages they promote, making users more likely to engage with the scams than if they had encountered them via traditional spam or phishing emails.

Technical Implications

This campaign represents a sophisticated shift in traffic hijacking techniques. Most common redirects occur at the page level—such as through compromised JavaScript or modified HTML—which are relatively easy for security scanners to detect. However, by operating as a malicious Apache module, the hijack occurs within the server's core processing logic. This makes the redirection harder to identify through standard website audits and allows the attackers to maintain a more persistent and stealthy presence on the compromised infrastructure.

Infrastructure Vulnerability

Beyond the technical execution, the campaign highlights a critical vulnerability in Brazil's public digital infrastructure. The successful compromise of government and educational servers suggests systemic gaps in server hardening and monitoring within these institutions. As cybercrime groups increasingly target the server module level, the risk to critical public services grows, potentially exposing sensitive data or allowing for further escalation of privileges within government networks.

Future Outlook

Security researchers continue to monitor the evolution of Gambling Goblin's tactics to determine if the group is expanding its target list beyond Brazil. While the current focus remains on betting fraud, the ability to install custom modules on government servers provides a blueprint for more destructive attacks, such as data exfiltration or the deployment of ransomware. Organizations are encouraged to audit their Apache configurations and monitor for unauthorized module installations.