Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages
-
A Chinese-speaking threat actor, tracked as Gambling Goblin, is compromising Apache web servers at Brazilian government and educational institutions to redirect legitimate visitors toward attacker-controlled pages promoting online gambling and sports betting.
According to Check Point Research, this campaign has been active since mid-2025. The attackers deploy malicious Apache modules on the compromised servers, allowing them to intercept and reroute traffic without altering the core website files, making detection by standard file integrity checks less straightforward.
Key technical details of the operation include:
- The malicious modules are specifically designed for Apache HTTP Server, enabling request-level redirection.
- The target set includes domains ending in
.gov.brand academic institutions, reflecting a focus on high-traffic, authoritative sites. - The ultimate aim of the redirection is monetization via illegal betting page impressions and potential credential or payment data harvesting on the landing pages.
The main risk here is that unsuspecting users who trust these official domains may be exposed to phishing-style lures for gambling services, which could also lead to financial fraud. Check Point researchers emphasize that these module injections are difficult to spot without regular server-level log audits and binary analysis of loaded modules.
For defenders, the following mitigation steps are recommended:
- Conduct regular reviews of loaded Apache modules (
httpd -M) to spot unfamiliar entries. - Monitor server access logs for unusual patterns of redirect responses (3xx) to external domains.
- Ensure that web server binaries and module directories are under strict file integrity monitoring (e.g., Tripwire or AIDE).
- Keep Apache and all associated libraries patched to the latest versions to close known privilege escalation routes.
Source: The Hacker News
Given that these attacks leverage legitimate server infrastructure rather than user-side exploits, how is your organization auditing its Apache module integrity and detecting unauthorized outbound redirects?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login