According to Check Point Research, this campaign has been active since mid-2025. The attackers deploy malicious Apache modules on the compromised servers, allowing them to intercept and reroute traffic without altering the core website files, making detection by standard file integrity checks less straightforward.

Key technical details of the operation include:

• The malicious modules are specifically designed for Apache HTTP Server, enabling request-level redirection.
• The target set includes domains ending in .gov.br and academic institutions, reflecting a focus on high-traffic, authoritative sites.
• The ultimate aim of the redirection is monetization via illegal betting page impressions and potential credential or payment data harvesting on the landing pages.

The main risk here is that unsuspecting users who trust these official domains may be exposed to phishing-style lures for gambling services, which could also lead to financial fraud. Check Point researchers emphasize that these module injections are difficult to spot without regular server-level log audits and binary analysis of loaded modules.

For defenders, the following mitigation steps are recommended:

• Conduct regular reviews of loaded Apache modules (httpd -M) to spot unfamiliar entries.
• Monitor server access logs for unusual patterns of redirect responses (3xx) to external domains.
• Ensure that web server binaries and module directories are under strict file integrity monitoring (e.g., Tripwire or AIDE).
• Keep Apache and all associated libraries patched to the latest versions to close known privilege escalation routes.

Source: The Hacker News

Given that these attacks leverage legitimate server infrastructure rather than user-side exploits, how is your organization auditing its Apache module integrity and detecting unauthorized outbound redirects?