Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages
- ID
- 20697
- Status
- summarized
- Published
- 02 Sep 2026, 9:44 PM
- Fetched
- 02 Sep 2026, 10:17 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/09/malicious-apache-modules-hijack.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 4.5
- Created
- 02 Sep 2026, 10:20 PM
- Tags
- Audience
- developersdatabase_learners
What happened
A Chinese-speaking cybercrime cluster dubbed 'Gambling Goblin' has been installing malicious Apache modules on compromised Brazilian government and educational web servers since mid-2025, reverse-proxying visitors to fake app-store phishing pages that push online gambling sites. Check Point Research reports the modules strip security headers and leverage high-reputation .gov.br domains for SEO manipulation. ANY.RUN separately identified 20+ compromised .gov.br portals in a related campaign it calls PhantomEnigma, noting these hosts are part of the delivery chain rather than the primary targets.
Why it matters
If you operate Apache web servers, this illustrates a real server-side compromise chain where attackers install malicious modules that transparently reverse-proxy your traffic — meaning your domain's reputation is weaponized without obvious defacement. The toolset includes 3snake, which uses ptrace on sshd/sudo processes to extract password strings, plus an SSH brute-forcer — a reminder to audit what modules are actually loaded on your Apache instances and to restrict SSH access rather than relying on password auth.
Discussion angle
The attack works because a compromised Apache module can intercept and rewrite all traffic before it leaves the server — discuss how you'd detect an unauthorized module on a production server and whether your current monitoring would catch reverse-proxying behavior that doesn't trigger any defacement alerts.