Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages

A Chinese-speaking cybercrime group has been installing malicious Apache modules on compromised web servers of Brazilian government and educational institutions. These modules are used to divert visitors to pages promoting online gambling and sports betting. The campaign, attributed to a group known as Gambling Goblin, has been tracked by Check Point Research since mid-2025. The attackers are targeting Brazilian government and educational institutions' web servers to hijack traffic for their own purposes. The malicious modules allow the attackers to control the traffic diversion. The campaign's activities involve promoting online betting pages to the hijacked visitors.