Brazilian Government Sites Compromised by ‘Gambling Goblin’ Malware, Users Redirected to Betting Pages

A cybercrime group identified as the Chinese‑speaking “Gambling Goblin” has been linked to the insertion of malicious Apache modules on web servers operated by Brazilian government agencies and educational institutions. The compromised servers are being used to silently reroute ordinary visitors to external sites that promote online gambling, effectively turning public traffic into a revenue stream for the attackers.

Security researchers say the group exploits the flexibility of the Apache HTTP Server, a widely used web platform, by loading custom modules that can intercept and modify HTTP requests. Once installed, the modules rewrite URLs or inject redirect scripts, causing users who access legitimate government or university pages to be sent to betting portals without any visible warning.

The campaign appears to target high‑visibility domains, leveraging the trust that citizens place in official Brazilian sites. By hijacking traffic at the server level, the attackers avoid the need for phishing emails or malicious downloads, making the redirection harder to detect for end users. The focus on gambling pages suggests a financial motive, with the perpetrators likely earning commissions from each click or signup generated through the illicit redirects.

Brazilian authorities have opened investigations into the breach, coordinating with cybersecurity firms to map the extent of the compromised infrastructure. Initial findings indicate that the malicious modules were deployed across multiple servers, but the exact number of affected sites remains under review. Officials have urged administrators to audit their Apache configurations, remove unauthorized modules, and apply the latest security patches.

Experts warn that the incident underscores a broader risk for public sector web services worldwide, where outdated software or misconfigured servers can become entry points for profit‑driven cybercrime. They recommend regular vulnerability scanning, strict access controls, and continuous monitoring of web traffic patterns to spot anomalous redirects. As the investigation proceeds, the focus will be on restoring the integrity of Brazil’s online portals and preventing similar intrusions in the future.