SECURITY researchers have traced a broad operation, attributed with medium-to-high confidence to Gambling Goblin, a Chinese-speaking actor linked to Earth Berberoka, that target Brazilian federal, state and municipal government websites. The campaign begins with automated network reconnaissance using a tool called cam-agent, a Go-based bundle that includes open-source scanners such as httpx, nuclei and naabu.
When an unpatched public-facing server is identified, the attackers breach it and install custom Apache modules directly on the host, using a Bash script to determine the distro, compile the module, and then erase build artefacts to blend in with legitimate files. The core module manipulates incoming requests (notably prefixes like /wps and /card), relaying traffic to attacker-controlled infrastructure and stripping the server’s Content-Security-Policy headers so injected content can run unchecked.
Following this manipulation, the intruders deploy deceptive landing pages on the compromised sites that mimic popular app stores (Google Play, Microsoft Store, Amazon) but actually promote Brazilian sports betting and lottery content in Portuguese. The pages feature fabricated user ratings and metadata to improve search ranking, leveraging legitimate .gov[.]br domains so search engines push them high in results.
The attackers also establish persistence with a Linux malware toolkit: a Go downloader named DownPro (which drops a setuid root backdoor and a credential harvester) and a modular backdoor, AlphaAgent, that masquerades as system daemons and communicates over encrypted gRPC, with capabilities including remote shells and traffic forwarding; ORAT is also deployed as a remote access tool with an embedded SSH server.
The operation has already compromised dozens of public-sector portals and, in some cases, other municipal sites, with the potential to broaden to supply additional malware payloads or broader fraud. Authorities and defenders are urged to audit for rogue Apache modules, enforce MFA on administrative access, patch exposed applications promptly and monitor for anomalous outbound traffic.