Chinese-Speaking Crew Slips Malicious Apache Modules Onto Brazilian .gov and .edu Sites

Key points

• Check Point Research has tracked a Chinese-speaking group it calls Gambling Goblin since mid-2025.
• The crew planted malicious Apache modules on Brazilian government and university web servers.
• Infected servers quietly redirected search-engine visitors to pages selling online casinos and sports betting.
• Attribution rests on language artefacts and overlapping infrastructure, so it carries medium confidence.
• Site owners should audit installed Apache modules and flag any unfamiliar shared object files.

A Chinese-speaking cybercrime crew has been quietly tampering with Brazilian government and university websites to push visitors towards gambling pages, according to Check Point Research. The group is tracked as Gambling Goblin, and the campaign has been running since around mid-2025. Brazil has drawn sustained criminal attention this year: our 1 September story on the Breeze Comet crew draining bank accounts through payment software documented a separate operation hitting Brazilian banks and retailers since 2024.

This operation targets web servers rather than visitors directly. Most Brazilian public sites run Apache, one of the oldest and most widely deployed pieces of web server software. Apache can be extended with small add-ons called modules, much as a browser takes plugins. The attackers wrote their own malicious module and installed it on servers they'd already compromised. Once loaded, it sat inside the trusted web server and watched incoming traffic.

What did the malicious module actually do?

It hijacked traffic selectively. Visitors arriving from search engines were quietly redirected away from the real government or university page and towards attacker-controlled pages advertising online casinos and sports betting. Administrators checking the site directly saw the normal page. That selective behaviour is deliberate: it keeps the site looking healthy to its owners while the criminals extract commercial value from its search ranking, a technique analysts call SEO poisoning. Check Point says the redirect pages point at gambling brands that pay affiliate commissions, so every diverted click can generate revenue for the operators.

Who is Gambling Goblin, and how sure are we?

Gambling Goblin is a name Check Point uses for this specific activity cluster. It isn't a nation-state group. The evidence pointing to Chinese-speaking operators includes language strings embedded in the tooling and infrastructure overlapping with earlier Chinese-language gambling-promotion campaigns. That's enough for medium-confidence attribution to a Chinese-speaking criminal cluster. It isn't enough to name a sponsor or a specific organisation, and Check Point doesn't try to.

The TTPs here, planting a rogue Apache module, filtering victims by referrer, monetising through affiliate gambling pages, overlap with other Chinese-language SEO-poisoning crews seen hitting Southeast Asian and Latin American servers over the past two years. Check Point Research has been active on the disclosure circuit lately; we covered their finding that Microsoft's own antivirus driver can be turned into a weapon at boot on 21 August.

Should ordinary Brazilians worry?

Probably not directly. The campaign is about making money from redirected clicks, not stealing personal data from citizens or planting malware on their devices. If you were bounced from a .gov.br page to a betting site, close the tab and don't enter card details. There's no sign the underlying government services or databases were touched. The people who need to act are the site administrators.

What should site owners do now?

List every Apache module loaded on your server and compare it against what your team actually installed. Anything unfamiliar, especially a shared object file (a .so file) sitting outside the standard package paths, deserves a hard look. Rotate credentials for anyone with server access and check web logs for redirects triggered only on search-engine referrers. If one server in an estate was reachable, assume others may have been too.