Chinese-Speaking Threat Cluster Uses Malicious Apache Modules to Redirect Brazilian Government Sites to Betting Pages

What Happened

Check Point Research reports that a Chinese-speaking cybercrime cluster tracked as Gambling Goblin has compromised web servers belonging to Brazilian government and educational institutions, installing malicious Apache modules to hijack visitor traffic. Compromised sites silently redirect visitors to attacker-controlled pages promoting online gambling and sports betting. Check Point says it has been tracking this campaign since mid-2025.

Why It Matters

This is a server-side compromise targeting trusted, high-traffic domains (.gov and .edu properties), which lends the redirected betting pages an unearned veneer of legitimacy and can expose institutional users and the public to fraudulent or unregulated gambling operators. Beyond reputational damage to the affected institutions, the underlying access — a malicious Apache module running with server privileges — represents a persistent foothold that could in principle be repurposed for more damaging activity beyond traffic redirection. At the time of reporting, specifics on the initial access vector and full scope of affected servers were not detailed.

What Defenders Should Watch For

• Audit installed Apache modules (httpd -M / apachectl -M) against a known-good baseline; investigate any unexpected or unsigned .so modules in mods-available/mods-enabled or the module load path.
• Review httpd.conf/apache2.conf and vhost configs for unauthorized LoadModule directives.
• Monitor for unexpected outbound redirects or injected content served to specific user agents/referrers (a common technique for cloaking malicious redirects from admins while serving them to real visitors).
• Check web server file integrity (module directories, config files) for recent, unauthorized modifications, and correlate with web server process spawning unusual child processes or network connections.
• Government and education IT teams should treat internet-facing Apache servers as high-value targets and prioritize patching, least-privilege service accounts, and regular module/config integrity checks.

This is developing intelligence with limited public technical detail at this stage — no CVE or specific initial-access vulnerability has been identified in current reporting. For the full write-up, see the original report from The Hacker News.