AI Weekly Malaysia

A Chinese-speaking cybercrime cluster dubbed 'Gambling Goblin' has been installing malicious Apache modules on compromised Brazilian government and educational web servers since mid-2025, reverse-proxying visitors to fake app-store phishing pages that push online gambling sites. Check Point Research reports the modules strip security headers and leverage high-reputation .gov.br domains for SEO manipulation. ANY.RUN separately identified 20+ compromised .gov.br portals in a related campaign it calls PhantomEnigma, noting these hosts are part of the delivery chain rather than the primary targets.

Why: If you operate Apache web servers, this illustrates a real server-side compromise chain where attackers install malicious modules that transparently reverse-proxy your traffic — meaning your domain's reputation is weaponized without obvious defacement. The toolset includes 3snake, which uses ptrace on sshd/sudo processes to extract password strings, plus an SSH brute-forcer — a reminder to audit what modules are actually loaded on your Apache instances and to restrict SSH access rather than relying on password auth.