A Chinese-speaking crew turned Brazilian .gov sites into SEO infrastructure. Their Apache module strips the CSP on three paths and leaves the rest correct.

Check Point Research published an account this morning of a Chinese-speaking cluster it calls Gambling Goblin, which has been compromising Brazilian government and educational web servers since mid-2025 and turning them into search-engine infrastructure for gambling and sports-betting fraud.

The reputation of a .gov.br domain is the asset being stolen. Not its data, not its users, its search ranking.

The mechanism is a malicious Apache module, and it contains the finding a defender can act on today. The module does not compromise the whole site. It rewrites three hardcoded path prefixes, reverse-proxies those to attacker infrastructure, forwards the original Host header, and strips the site's Content-Security-Policy for exactly those paths while leaving the rest of the server untouched.

One server, two postures, decided by the path

Why the obvious check fails

A site owner who wants to know whether they are affected will fetch their own homepage and look at the response headers. That test cannot fail, because the homepage is not what was changed.

Check Point describe the module registering at Apache's name-translation stage and inspecting every incoming request for a small set of hardcoded prefixes, in their samples /wps, /bmw and /card. On a match the request becomes a reverse-proxy request to an upstream address compiled into the module. On anything else, nothing happens.

For the matched paths the module "strips the upstream site's Content-Security-Policy headers" and "replaces them with a deliberately permissive policy that allows inline and dynamically evaluated scripts, third-party assets, and data: and blob: sources".

So the site keeps a valid certificate, a genuine domain, a real reputation and a correct security policy everywhere anybody looks, and loses its browser protections on three paths nobody enumerated.

That is the transferable lesson, and it is not about Apache. A response header is a property of a response, not of a site. Any monitoring that samples one URL per domain is measuring the wrong thing.

What the research does not claim

Two things are stated plainly in the source and will not survive the retelling.

The initial access was never observed. Check Point say so directly: "We have not directly observed this group's initial access." What they found was an exposed open directory holding a Go binary, a scanning and reconnaissance agent the operators call cluster-asset-mapping, or cam-agent. That tells you what the group uses to find targets. It does not tell you how any specific server fell, and a chain diagram that begins with a scanner exploiting a web server is drawing an inference rather than an observation.

The attribution carries a stated confidence level. They "assess with medium-to-high confidence" that Gambling Goblin is tied to Earth Berberoka, the cluster Trend Micro documented in 2022, and they show their work: shared oRAT codebase and operator routes, an AlphaAgent sample uploaded in the same archive as previously attributed tooling, Chinese-language operator artefacts, lookalike domain tradecraft, and C2 on an Amazon ASN the group has used before.

That is how attribution should be published, and it is worth naming because the contrast is sharp. Yesterday we covered Google's report on Breeze Comet, another actor operating against Brazilian payment infrastructure. That report stated no confidence level at all, and one outlet nonetheless reported it as a high-confidence attribution. Same country, same week, two very different standards of disclosure.

The AI claim, and how hedged it currently is

One sentence in the research is going to travel further than its evidence.

Describing the Bash installer, Check Point note that "the script's status messages are written in Chinese and decorated with emoji, a style that may point to AI-assisted development".

Read it exactly as written. It is an observation about formatting, offered as a possibility, with no supporting analysis. It is not a claim that the malware was written by a model, and Check Point do not present it as one.

It will be reported as one. The pattern is now familiar enough on this site to predict: a hedged sentence in a vendor report becomes a headline, and the qualifier does not survive the second telling. We have watched it happen four times in a fortnight with exploitation claims. This is the same mechanism applied to AI attribution, which is a harder claim to falsify and therefore a more durable error.

What is established, and what is inferred

Claim	Standing in the source
The Apache module reverse-proxies three prefixes and strips CSP	Established. They analysed the module’s source, opsproxy.c
Compiled on the victim, artefacts deleted, files timestomped	Established. Described from the Bash installer
Phishing pages impersonate Google Play, Microsoft Store and Amazon, monetised through gambling	Established. Fetched from the hardcoded upstream addresses
Parallel networks in Vietnamese, Spanish and English, with daily domain generation	Established. Found by pivoting through the infrastructure
Tied to Earth Berberoka	Assessed at medium-to-high confidence, with three named overlaps
How any server was initially compromised	Not observed. Inferred from a scanner found in an open directory
AI-assisted development	Speculation, hedged as “may point to”, resting on emoji in status messages
One configuration change from delivering malware	A capability observation, not observed behaviour. Nothing is reported as having been delivered

The pattern worth naming

This is the third time in four days that a briefing here has come down to the same shape: a control that is genuinely present, and absent exactly where it matters.

Packagist removed thirteen malicious packages and the fourteenth stayed listed. The KEV catalogue holds a JFrog entry, and it is not the JFrog flaw being exploited. Now a government site serves a correct Content-Security-Policy on every path except the three that were rewritten.

In all three cases the check a competent person would run returns a clean result. That is not coincidence, it is selection: attackers who leave the obvious indicator intact survive longer than those who do not, so the surviving campaigns are the ones that look fine from the front.

The practical response is unglamorous and it is the same each time. Check the specific thing rather than the general one, by identifier rather than by product, by path rather than by domain.