2026-09-03 · view entry permalink →
Gambling Goblin (Earth Berberoka overlap): a Chinese-speaking cluster compiles malicious Apache modules on compromised Brazilian .gov.br servers, borrowing their search-engine trust for a global gambling-SEO fraud network
Check Point Research documents Gambling Goblin, a Chinese-speaking cluster it assesses with medium-to-high
confidence overlaps Earth Berberoka, first documented by Trend Micro in 2022 targeting gambling platforms serving
Chinese-speaking users. Active against Brazilian organisations since mid-2025, primarily government and educational
institutions, the operation's distinguishing move is weaponising the search-engine trust of compromised .gov.br
domains: navigation tiles on the resulting fraud pages point to dozens of real domains spanning a federal ministry, a
national public agency, a state legislative assembly, state courts of accounts, a state utility, and numerous
municipal administrations
(Check Point Research, 2026-09-02).
The technique (compromising a government web server to graft attacker content onto its own trusted domain) is
directly transferable to any public-sector web-hosting estate, at any administrative tier, regardless of region.
On an already-compromised Linux host, a Bash installer confirms root, fingerprints the distribution, patches a
missing macro, and compiles a custom Apache module (opsproxy.c) via apxs, then deletes the build artefacts and
timestomps the resulting .so and its load configuration to match legitimate modules such as mod_ssl or
mod_suexec
(Check Point Research, 2026-09-02).
The module registers at Apache's name-translation stage and inspects every incoming request for a small set of
hardcoded URL prefixes (/wps, /bmw, /card in the analysed samples); a match rewrites the request into a
reverse proxy to a hardcoded upstream, so the visitor is silently relayed to attacker infrastructure while the
request still appears, from the outside, to originate from the legitimate compromised domain
(Check Point Research, 2026-09-02).
The module also strips the site's own Content-Security-Policy header and replaces it with a permissive one allowing
inline/eval'd scripts and third-party assets, so the injected phishing content renders unrestricted. A second,
separate Apache module disguises itself as a basic filter, decrypts an RC4-protected ruleset keyed on
path/referrer/User-Agent/client-IP, locates the page body via a compiled-in <body.*?> regex, and injects
fetched remote content via ap_rwrite, classic SEO-cloaking and content-injection behaviour, distinct from the
reverse-proxy module
(Check Point Research, 2026-09-02).
The upstream phishing pages impersonate Google Play, Microsoft Store and Amazon with fabricated ratings and
schema.org metadata, pushing gambling and sports-betting content.
Beyond the Apache modules, the group runs an internet-facing reconnaissance agent (a Go ELF binary wrapping
dirprobe, httpx, naabu, nuclei v3, subfinder and whatweb over gRPC C2) to map attack surface, plus a downloader
(DownPro) that stages the rest of the toolkit, blending its drop paths into names mimicking legitimate system
binaries. Two backdoors carry Check Point's own attribution basis: oRAT, a Go RAT with an embedded SSH/SFTP
server that persists as a systemd service disguised as the legitimate xtables-addons netfilter package, disables
SELinux enforcement (setenforce 0) as part of its setup routine, and masquerades its process as sshd:
root@pts/0, sharing the same orat/cmd/agent codebase and REST-style operator routes Check Point tied to Earth
Berberoka in 2022
(Check Point Research, 2026-09-02).
AlphaAgent, a modular Go backdoor using gRPC-over-HTTPS with browser-fingerprint mimicry (or a DNS covert
channel) and bundling a SOCKS5 proxy and Ligolo-style relay for pivoting, was recovered from the same archive as
tools already attributed to Earth Berberoka, placing it directly alongside the group's known toolset
(Check Point Research, 2026-09-02).
A third attribution point is infrastructure: the group's command-and-control shares Earth Berberoka's historical
Amazon ASN (AS16509)
(Check Point Research, 2026-09-02).
A credential stealer built on the open-source 3snake project intercepts sshd/sudo/su/ssh/passwd/kinit/
login executions via netlink process-event monitoring and ptrace, masquerading as one of roughly 29 fake
kernel-thread process names. Check Point states the model is already exported beyond Brazil: parallel phishing
templates localised for Vietnamese, Spanish and English audiences, with daily domain generation.
No source describes how the group obtains its initial foothold on a target web server, the reporting begins from already-established root access. Defenders should read this as post-compromise infrastructure abuse, not an exploitation narrative to patch against.
Triage and hunting: a sudden absence of Content-Security-Policy headers on specific URL paths of a public-sector
web server is a strong signal of injected reverse-proxy behaviour
(Check Point Blog, 2026-09-02).
Audit installed Apache modules for .so files timestamped to match legitimate modules such as mod_ssl or
mod_suexec; a mismatch between a module's claimed identity and its actual behaviour is the core detection
concept, not any single file name
(Check Point Blog, 2026-09-02).
Further behavioural artefacts a defender can hunt for without treating them as fixed indicators: a systemd service
claiming to be xtables-addons that does not match the real package's binary; a process presenting as sshd but
running from an unexpected path; unexplained apxs/module-compilation activity on a production web server outside
a maintenance window; and process names drawn from common kernel-worker naming conventions (kworker, ksoftirqd,
watchdog, journald) that do not correspond to genuine kernel threads when inspected further.
The group compromises legitimate Brazilian government web servers, many of them .gov.br sites spanning federal, state, and municipal institutions, and installs malicious modules that silently turn them into reverse proxies for phishing content, invisible to the visitor
We assess with medium-to-high confidence that Gambling Goblin is tied to Earth Berberoka
Audit Apache configurations and installed modules. Look for unexpected .so files, especially any timestamped to match legitimate modules like mod_ssl or mod_suexec.
oRAT was tied to Earth Berberoka in 2022, and the variant we analyzed shares the same orat/cmd/agent codebase and REST-style operator routes
one of the AlphaAgent samples we recovered was uploaded in the same archive as other tools previously attributed to Earth Berberoka, placing AlphaAgent directly alongside the group's known toolset