A Chinese-speaking cybercrime group has been abusing compromised government and public-sector websites to manipulate search results and promote online gambling. Researchers at Check Point Research say the campaign, dubbed Gambling Goblin, uses the reputation of trusted domains as infrastructure for SEO fraud and could potentially be adapted for malware distribution.
The operation has primarily targeted Brazilian public and educational organisations. After compromising a server, attackers install malicious Apache modules that allow selected paths on legitimate websites to act as reverse proxies for content controlled by the criminals.
Trusted domains become part of the attack
Users can continue to see the legitimate government domain in their browser even though the content is being served through infrastructure controlled by the attackers. The malicious module can also weaken Content Security Policy settings, allowing external or injected scripts to run.
Researchers found infrastructure imitating well-known services and app stores while directing visitors toward gambling and betting websites. By placing such content behind established public-sector domains, attackers can exploit their reputation in search engines and improve the visibility of fraudulent pages.
A campaign designed to scale
Check Point Research identified infrastructure capable of generating new domains and templates prepared for multiple languages. That suggests the operation was designed to expand beyond a single country.
The researchers warn that the same technical setup could be reconfigured to distribute malicious software, although they have not confirmed malware delivery as the campaign’s current objective. The case illustrates how compromised web infrastructure can remain useful to attackers even without ransomware or visible service disruption.
