Why Were Brazilian Government Websites Sending Visitors to Gambling Pages?
A visitor could see a Brazilian government domain in the address bar and still end up on an attacker-controlled gambling page. The website had not simply been defaced. Its trusted identity had been turned into part of a search, phishing and malware operation.
Check Point Research calls the campaign Gambling Goblin and links it with medium-to-high confidence to the Chinese-speaking cluster Earth Berberoka. Since at least mid-2025, the group has compromised Brazilian government and education websites and used them as durable front doors for malicious content.
The official URL stayed visible
The attackers deployed malicious Apache modules that acted as reverse proxies. Requests to selected paths were quietly fetched from attacker infrastructure while the victim’s legitimate domain remained in the browser.
That makes the deception much stronger than a link that immediately redirects to an unfamiliar domain. Users, search engines and automated security systems see the reputation of a government agency or university while the attacker controls what appears at the path.
The modules also stripped Content Security Policy and other defensive headers from proxied responses. This reduced the chance that the legitimate site’s browser protections would break the attacker’s scripts or expose the content mismatch.
One compromise supported several businesses
Gambling pages were a prominent outcome, but the infrastructure was not limited to betting. Researchers found fake stores, phishing content and search-engine optimisation abuse. Compromised domains gave the operators credible links, favourable indexing and a way to rotate campaigns without rebuilding reputation from zero.
The group also used Linux tooling including DownPro, AlphaAgent, oRAT and 3snake. The combination points to an operation interested in long-term access as well as short-lived web traffic.
Parallel activity in Vietnamese, Spanish and English suggests the model is designed to travel. Brazil may be the clearest cluster, but the playbook works anywhere a trusted public institution runs a vulnerable web stack.
The real asset was institutional trust
Public-sector and university websites are often treated as informational assets rather than transaction systems. That can leave them with slower patch cycles, shared hosting, legacy components and limited runtime monitoring.
Gambling Goblin shows why that classification is dangerous. A compromised public domain can influence search rankings, validate a phishing lure and reassure victims at the exact moment they should become suspicious.
What defenders should look for
Administrators should compare loaded Apache modules with approved baselines, inspect unusual path-specific proxy behaviour and monitor changes to response headers. Search-console alerts, unexpected indexed pages and traffic spikes to obscure URLs can reveal abuse that ordinary homepage checks miss.
Teams should also test what anonymous visitors receive from different regions, user agents and referrers. Malicious modules can cloak content so that administrators see the normal site while selected users or search crawlers receive the scam.
The most valuable thing on a government web server may not be the data stored there. It may be the public belief that anything delivered under that domain deserves trust.
Reference
Continue the series: LATAM Cyber & Digital Law Series index
