# Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages
A Chinese-speaking cybercrime group called Gambling Goblin has been installing malicious Apache modules on web servers operated by Brazilian government and educational institutions, redirecting site visitors to attacker-controlled gambling and sports betting pages. Check Point Research identified and has been tracking this campaign since mid-2025.
The attack exploits a fundamental weakness in web server architecture. Apache, the world's most widely used open-source web server, loads modules that extend its functionality. Gambling Goblin weaponizes this by injecting unauthorized modules into compromised servers. These modules intercept legitimate traffic and perform real-time session hijacking, automatically redirecting visitors to fraudulent betting sites without legitimate site operators' knowledge.
The threat actors gain initial access to servers through credential compromise, unpatched vulnerabilities, or supply chain weaknesses. Once installed, the malicious modules operate at the Apache process level, making detection difficult. Traditional perimeter security and standard intrusion detection systems often miss kernel-level or process-level tampering. The modules run silently, only executing the redirect logic when external visitors arrive, leaving minimal forensic traces.
Brazilian government agencies and educational institutions face particular risk. These organizations typically host high-traffic sites with substantial visitor volumes, making them valuable targets for criminals seeking scale. A single compromised server redirecting thousands of daily visitors to betting operations generates significant referral revenue. The attacker gains immediate monetization without launching phishing campaigns or distributing malware to end users.
This approach differs from conventional credential theft or ransomware deployment. Gambling Goblin prioritizes stealth and sustained revenue over rapid extortion. The longer a malicious module remains undetected, the more traffic monetization occurs. Site administrators may notice unusual traffic patterns or visitor complaints before discovering the actual compromise.
Check Point's tracking reveals the campaign targets Apache installations specifically, suggesting operators possess technical knowledge of web server internals. Chinese-language artifacts in the malicious code indicate the cluster operates from or maintains connections to Chinese-speaking regions. The group's focus on Brazilian targets reflects broader cybercriminal interest in Latin American financial systems and the region's substantial online gambling market.
Organizations running Apache servers should implement immediate detection measures. Regular filesystem audits, module integrity verification, and process monitoring can identify unauthorized Apache modules. Logs showing suspicious module loads or unexpected traffic redirects warrant immediate investigation. Check Point recommends comparing loaded modules against officially deployed configurations and reviewing Apache process behavior under network monitoring.
The campaign underscores persistent risks in web server security. Even organizations with strong endpoint protection and network defenses remain vulnerable when attackers compromise foundational infrastructure. Brazilian government agencies have reportedly begun conducting infrastructure audits, though the scope and effectiveness of remediation efforts remain unclear.
No statement from Brazilian government cybersecurity authorities has been released. The campaign's continuation into 2025 indicates either limited detection success or incomplete remediation across affected organizations.