Gambling Goblin Hijacks Brazilian Websites for Gambling SEO Fraud

Check Point Research reported that the Chinese-speaking Gambling Goblin cybercrime cluster has compromised Brazilian government, educational, and commercial Linux web servers since mid-2025. The operators install malicious Apache modules that covertly reverse-proxy traffic from trusted victim domains to fake Google Play, Microsoft Store, and Amazon-branded gambling and betting pages, abusing the victims’ reputations to manipulate search-engine rankings at scale.

The group uses an obfuscated Linux toolkit including DownPro, ChUser, PasswordHarvester, AlphaAgent, oRAT, an SSH brute-forcer, and reconnaissance utilities to steal credentials, maintain persistence, move laterally, and remotely administer compromised hosts. Researchers assess with medium-to-high confidence that Gambling Goblin is linked to Earth Berberoka, citing shared oRAT code, Chinese-language artifacts, gambling-focused operations, lookalike-domain techniques, and overlapping Amazon-hosted infrastructure; associated systems also host Vietnamese, Spanish, and English phishing content and generate domains daily, creating capacity to expand internationally or distribute malware.