Gambling Goblin (Earth Berberoka overlap): a Chinese-speaking cluster compiles malicious Apache modules on compromised Brazilian .gov.br servers, borrowing their search-engine trust for a global gambling-SEO fraud network

Check Point Research documents Gambling Goblin, a Chinese-speaking cluster it assesses with medium-to-high confidence overlaps Earth Berberoka, first documented by Trend Micro in 2022 targeting gambling platforms serving Chinese-speaking users. Active against Brazilian organisations since mid-2025, primarily government and educational institutions, the operation's distinguishing move is weaponising the search-engine trust of compromised .gov.br domains: navigation tiles on the resulting fraud pages point to dozens of real domains spanning a federal ministry, a national public agency, a state legislative assembly, state courts of accounts, a state utility, and numerous municipal administrations (Check Point Research, 2026-09-02). The technique (compromising a government web server to graft attacker content onto its own trusted domain) is directly transferable to any public-sector web-hosting estate, at any administrative tier, regardless of region.

On an already-compromised Linux host, a Bash installer confirms root, fingerprints the distribution, patches a missing macro, and compiles a custom Apache module (opsproxy.c) via apxs, then deletes the build artefacts and timestomps the resulting .so and its load configuration to match legitimate modules such as mod_ssl or mod_suexec (Check Point Research, 2026-09-02). The module registers at Apache's name-translation stage and inspects every incoming request for a small set of hardcoded URL prefixes (/wps, /bmw, /card in the analysed samples); a match rewrites the request into a reverse proxy to a hardcoded upstream, so the visitor is silently relayed to attacker infrastructure while the request still appears, from the outside, to originate from the legitimate compromised domain (Check Point Research, 2026-09-02). The module also strips the site's own Content-Security-Policy header and replaces it with a permissive one allowing inline/eval'd scripts and third-party assets, so the injected phishing content renders unrestricted. A second, separate Apache module disguises itself as a basic filter, decrypts an RC4-protected ruleset keyed on path/referrer/User-Agent/client-IP, locates the page body via a compiled-in <body.*?> regex, and injects fetched remote content via ap_rwrite, classic SEO-cloaking and content-injection behaviour, distinct from the reverse-proxy module (Check Point Research, 2026-09-02). The upstream phishing pages impersonate Google Play, Microsoft Store and Amazon with fabricated ratings and schema.org metadata, pushing gambling and sports-betting content.

Beyond the Apache modules, the group runs an internet-facing reconnaissance agent (a Go ELF binary wrapping dirprobe, httpx, naabu, nuclei v3, subfinder and whatweb over gRPC C2) to map attack surface, plus a downloader (DownPro) that stages the rest of the toolkit, blending its drop paths into names mimicking legitimate system binaries. Two backdoors carry Check Point's own attribution basis: oRAT, a Go RAT with an embedded SSH/SFTP server that persists as a systemd service disguised as the legitimate xtables-addons netfilter package, disables SELinux enforcement (setenforce 0) as part of its setup routine, and masquerades its process as sshd: root@pts/0, sharing the same orat/cmd/agent codebase and REST-style operator routes Check Point tied to Earth Berberoka in 2022 (Check Point Research, 2026-09-02). AlphaAgent, a modular Go backdoor using gRPC-over-HTTPS with browser-fingerprint mimicry (or a DNS covert channel) and bundling a SOCKS5 proxy and Ligolo-style relay for pivoting, was recovered from the same archive as tools already attributed to Earth Berberoka, placing it directly alongside the group's known toolset (Check Point Research, 2026-09-02). A third attribution point is infrastructure: the group's command-and-control shares Earth Berberoka's historical Amazon ASN (AS16509) (Check Point Research, 2026-09-02). A credential stealer built on the open-source 3snake project intercepts sshd/sudo/su/ssh/passwd/kinit/ login executions via netlink process-event monitoring and ptrace, masquerading as one of roughly 29 fake kernel-thread process names. Check Point states the model is already exported beyond Brazil: parallel phishing templates localised for Vietnamese, Spanish and English audiences, with daily domain generation.

No source describes how the group obtains its initial foothold on a target web server, the reporting begins from already-established root access. Defenders should read this as post-compromise infrastructure abuse, not an exploitation narrative to patch against.

Triage and hunting: a sudden absence of Content-Security-Policy headers on specific URL paths of a public-sector web server is a strong signal of injected reverse-proxy behaviour (Check Point Blog, 2026-09-02). Audit installed Apache modules for .so files timestamped to match legitimate modules such as mod_ssl or mod_suexec; a mismatch between a module's claimed identity and its actual behaviour is the core detection concept, not any single file name (Check Point Blog, 2026-09-02). Further behavioural artefacts a defender can hunt for without treating them as fixed indicators: a systemd service claiming to be xtables-addons that does not match the real package's binary; a process presenting as sshd but running from an unexpected path; unexplained apxs/module-compilation activity on a production web server outside a maintenance window; and process names drawn from common kernel-worker naming conventions (kworker, ksoftirqd, watchdog, journald) that do not correspond to genuine kernel threads when inspected further.