Unmasking the 'Gambling Goblin': A Huge SEO Scam by a Chinese Threat Group

In a startling revelation, Check Point Research (CPR), the threat intelligence division of Check Point® Software Technologies, has uncovered a significant cybersecurity threat emanating from a Chinese-speaking group known as 'Gambling Goblin.' This group has been leveraging compromised Brazilian government websites to orchestrate a massive SEO scam.

Overview of the Threat

The 'Gambling Goblin' group infringes on .gov.br domains, which are managed by various federal, state, and municipal public institutions in Brazil. They exploit the high trustworthiness associated with these government websites to facilitate their fraudulent activities. By embedding malicious modules into the servers, they covertly redirect visitors to phishing content designed to trick and exploit unsuspecting users.

The phishing pages masquerade as legitimate platforms, including prominent sites like Google Play, Microsoft Store, and Amazon. Complete with fake reviews and ratings, these pages aim to lure users into online gambling and sports betting under the guise of trusted shopping experiences.

Connections to Past Cybercrime

Interestingly, the activities of the 'Gambling Goblin' group show ties to 'Earth Berberoka,' another group known for targeting gambling websites across Asia. This connection highlights a concerning trend: the methods of cybercrime associated with gambling, which have persisted for years, are now being exported to new regions, further complicating the global cybersecurity landscape.

Ongoing campaigns linked to the 'Gambling Goblin' have been closely monitored since mid-2025, revealing an alarming shift in how cybercriminals utilize trusted infrastructures for deceitful purposes. The implications are significant, as these cybercriminals use SEO manipulation as a weapon to mask malicious intents, ultimately focusing on global expansion by infiltrating reputable websites.

The Situation in Brazil

Brazil has emerged as a hotspot where these sophisticated methods are being rolled out. Traditionally dominated by local cybercrime groups utilizing banking Trojan horses, the landscape is shifting. Cybercrime targeting the gambling sector has reached new markets, with phishing pages localized not only for Portuguese but also for Vietnamese, Spanish, and English speakers.

Moreover, daily updates of generated domains signify a well-structured model of fraud designed for mass deployment. Upon breaching trusted servers, the 'Gambling Goblin' group employs a multifaceted and obfuscated Linux toolkit, comprising bespoke downloaders, several backdoors, and tools for credential theft, along with reconnaissance agents to map exposed infrastructures.

The ultimate aim is apparent at the network level. The group implants an Apache module into compromised servers, subtly redirecting users to phishing sites, all while the browser's address bar remains oblivious to the external domains at play. This malicious module disables security headers, allowing embedded scripts to execute unchecked, thus converting reliable servers into hidden entry points for cybercriminal activities.

Deceptive Practices and Strategies

The phishing pages are meticulously crafted to deceive both humans and search engines alike. They not only impersonate reputable platforms like Google Play and Amazon, but they also employ fabricated ratings and structured metadata to enhance their legitimacy. Yet, their core objective remains unchanged—to funnel victims into engaging in online gambling and betting activities.

Instances have been observed where these counterfeit pages link back to several legitimate domains, with most of them falling under '.gov.br' domains. By leveraging the already high search rankings of these official domains, the attackers effectively push their gambling-related content towards the top of search results, hijacking the ensuing traffic.

Additionally, investigations into the generated domains have unveiled links to gambling and adult content sites targeting Chinese-speaking users, with overlapping infrastructures that include previously linked Amazon shared ASNs from the 'Earth Berberoka' group.

The Need for Vigilance

This widespread campaign reveals a concerning trend where trust is being systematically and industrially exploited against organizations. Tools typically reserved for espionage-level operations are now part of the cybercriminal arsenal, further blurring the line between conventional cybercrime and Advanced Persistent Threat (APT) activities. The risks associated with these phishing pages extend beyond SEO scams, as changes in infrastructure configurations could pave the way for them to directly distribute malicious applications to victims.

Defensive Measures

To counteract these threats, organizations must take proactive approaches:

- Audit Apache Settings and Installed Modules: Pay close attention to unexpected .so files, especially those masquerading as legitimate modules with matching timestamps.
- Watch for Disabled Security Headers: A sudden deactivation of the Content-Security-Policy header at specific URL paths may indicate embedded reverse proxy behaviors.
- Protect Domain Evaluations as Assets: Breaches of .gov domains not only affect direct users but can also weaponize trust to facilitate mass-targeted scams.
- Actively Search for Spoofed Processes and Malicious Apache Modules: Security teams should address all forms of malware, including these emerging risks.

Conclusion

The resilience of the cybersecurity landscape lies in constant vigilance and proactive measures against evolving threats. As evidenced by the actions of the 'Gambling Goblin,' the line between legitimate activities and cybercrime continues to blur, demanding attention from all sectors of society. Organizations are urged to watch closely and adapt their defense strategies in this ever-evolving digital frontier.