Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon

The Gambling Goblin threat actor conducts a sustained campaign against Brazilian government and educational institutions by compromising web servers and deploying malicious Apache modules that silently reverse-proxy visitors to phishing pages. These phishing pages impersonate legitimate app stores such as Google Play and Microsoft Store but promote gambling and betting services. The attackers manipulate SEO by linking compromised high-reputation domains to boost phishing page visibility. Their toolkit includes custom Linux malware components for downloading additional payloads, maintaining persistence, stealing credentials, and conducting reconnaissance. The operation is heavily obfuscated to evade detection and extends beyond Brazil to other countries including Vietnam, Spain, and English-speaking regions.

The campaign compromises trusted government and educational websites to redirect users to phishing pages, potentially leading to credential theft and exposure to fraudulent gambling services. The manipulation of search engine rankings increases the likelihood of victim exposure. The use of backdoors and credential stealers indicates potential for further system compromise and data theft. The operation's obfuscation and multi-country targeting increase its complexity and risk.

No vendor advisory or patch information is available for this threat. Organizations should focus on detecting and removing malicious Apache modules and associated Linux malware components. Monitoring for unusual reverse-proxy configurations and unexpected outbound connections to phishing infrastructure is recommended. Since this is a targeted campaign leveraging compromised servers, hardening web servers, applying security best practices for server management, and conducting thorough incident response on affected systems are advised.