Research by: Amit Yardeni
Since mid-2025, Check Point Research has tracked a sustained campaign against Brazilian organizations. The tradecraft points to a Chinese-speaking cybercrime group connected to Earth Berberoka, an actor first documented targeting gambling sites across Asia.
Once inside a victim, the group deploys a broad Linux toolkit: a custom downloader, several backdoors, and familiar offensive utilities. Most of it arrives heavily obfuscated – wrapped in layered virtualization and packing to slow analysis and evade detection.
The purpose becomes clear at the network layer. The attackers install custom Apache modules that quietly proxy visitors to a sprawling set of phishing pages. Many of those pages sit on Brazilian government domains that appear to have been compromised and repurposed without their owners’ knowledge.
The reach extends beyond Brazil. We uncovered a second phishing network run by the same actor; this one is built for Vietnamese victims.
The likely goal is SEO manipulation at scale. By hijacking trusted, high-reputation domains, many of them Brazilian government sites, the operators borrow that reputation to push their own content up the search rankings and hijack the traffic that follows. But the same infrastructure could serve a more dangerous end: the phishing pages impersonate app-download destinations such as Google Play, the Microsoft Store, and Amazon, which leaves the operators one step from pushing malware straight to victims.
We have not directly observed this group’s initial access, but a revealing artifact surfaced on one of their servers: an exposed open directory hosting an ELF binary written in Go that bundles numerous reconnaissance and scanning plugins. The toolset reads like a complete attack-surface-mapping pipeline for internet-facing targets.
The group refers to this agent as “cluster-asset-mapping
”, or “cam-agent
” for short. It runs with a handful of flags:
f
)The agent carries a configuration that includes:
It logs to payload-run.log
under the default directory of /tmp/asset-scan
. The agent reads the JSON report policies to decide how to run its scan. The policies are driven by the following fields:
The agent communicates with its server over gRPC, authenticating with the certificates and keys from its own configuration. It uses many known open-source pentesting tools as modules:
The group automates deployment of its malicious Apache module through a Bash installer. The script first confirms it is running as root, then fingerprints the host as either Debian/Ubuntu or CentOS/RedHat and pulls in the matching Apache development packages so the module can be compiled on the victim itself. It downloads the module’s C source, opsproxy.c
, from a hardcoded staging server and, notably, patches the source on the fly to insert a missing macro definition so the code compiles cleanly. This is a small touch that shows the operators built the module to run across a range of victim configurations.
Compilation and installation are handled in a single step via Apache’s own apxs
tooling, which also wires the module into the server’s configuration. What follows is a deliberate effort to hide the intrusion: the script deletes the source and all build artifacts, then timestomps the resulting .so
and its load-configuration files to match legitimate, pre-existing Apache modules such as mod_ssl
or mod_suexec
, so the malicious files blend in during a casual review. It then enables the stock proxy, headers, and rewrite modules the malicious module depends on, tests the configuration, and restarts Apache to bring everything live.
Throughout, the script’s status messages are written in Chinese and decorated with emoji, a style that may point to AI-assisted development.
The source file, opsproxy.c
, reveals a purpose-built reverse proxy that quietly grafts attacker-controlled content onto a compromised web server. The module registers itself at Apache’s name-translation stage and inspects every incoming request for one of a small set of hardcoded URL prefixes which in our samples, /wps
, /bmw
, and /card
. When a request matches, the module rewrites it into a reverse-proxy request to a corresponding upstream server hardcoded into the source, silently relaying the visitor to attacker infrastructure while the request still appears, to the outside world, to come from the legitimate compromised domain.
To make that relayed content render without interference, the module strips the upstream site’s Content-Security-Policy headers. It replaces them with a deliberately permissive policy that allows inline and dynamically evaluated scripts, third-party assets, and data:
and blob:
sources. This removes the restrictions a browser’s CSP normally enforces, allowing injected or externally hosted scripts to execute freely.
The module also forwards the original Host
header and adds standard proxy headers so the upstream sees a convincing request. The effect is a compromised, reputable server acting as a stealthy front door: certain paths transparently serve attacker content, and the browser protections that would ordinarily block foreign scripts are switched off for exactly those paths.
A second ELF Apache module used by the group disguises itself as a basic filter module while registering request and response hooks that examine visitor headers, URI paths, referrers, and client IPs. It carries a static configuration, decrypts it with RC4, and parses it into two rule types:
Using a compiled-in regex for
to locate its injection point, the module expands placeholders such as {host}
, {hip}
, {url}
, and {name}
, fetches remote content with libcurl, and writes that content into Apache responses via ap_rwrite
and bucket manipulation. This gives a remote service control over what selected visitors and crawlers see on the compromised server. This is a behavior consistent with SEO cloaking and content-injection malware.
Fetching the content served from the three upstream IP addresses hard-coded in the proxy module reveals the phishing infrastructure itself. Each address hosts a page impersonating a trusted app-distribution platform, localized in Brazilian Portuguese (lang="pt-BR"
) and dressed up with fabricated ratings, review counts, and structured schema.org
metadata to appear legitimate to both users and search-engine crawlers.
All those IPs lean heavily on Bing’s thumbnail service (tse-mm.bing.com
) to source imagery, tag their Open Graph and Twitter cards with @GooglePlay
and @microsoftstore
handles, and consistently theme around online gambling and sports betting aimed at a Brazilian audience – the actual monetization behind the campaign’s search-manipulation scheme. Tellingly, the pages carry Chinese-language CSS comments (for example a comment translating to “bottom navigation bar — fixed to the bottom on mobile, hidden on desktop”), the same operator fingerprint seen across the group’s server-side tooling.
Inspecting the domain used by the second Apache module brought us to a domain called playfootball[.]info
that has a phishing page similar to the earlier ones. Unlike the earlier upstream samples that pulled assets from Bing thumbnails and a fake CDN, this one loads Google’s real production assets – the actual gstatic.com
Play Store CSS bundle, Material Icons fonts, and the genuine Google Play logo SVG.
The most revealing finding from this page is that the app tiles and nav links don’t point to a single server; they point to dozens of real Brazilian domains, the majority of them legitimate .gov.br
government sites, each serving the attacker’s gambling pages under paths like /jogos
and /nova
. The compromised institutions span every level of Brazilian government. At the federal level, they include a government ministry and a national public agency. At the state level, victims include a state legislative assembly, state courts of accounts, and a state-owned utility. The largest share, however, is local government: municipal administrations spread across numerous cities and multiple states. A smaller set of commercial .com.br
sites such as local news outlets, health clinics, and business associations rounds out the victims.
As we pivoted through the phishing infrastructure, the trail led well beyond Brazil. Several of the IP addresses hosted subdomain and domain generators, giving the operators a fresh supply of domains every day – a rotation scheme built to outpace blocklists and takedowns.
Some of the generated domains pointed to adult-content and gambling sites aimed at a Chinese-speaking audience, tying the infrastructure back to the operators’ origin and their long-running focus on the gambling sector.
Figure 11 – A gambling site in Chinese from the domain generator list
More telling, we found phishing pages built on the same template as the Brazilian ones, but localized in Vietnamese, Spanish, and English. The Brazilian operation is not a one-off: the same playbook is being adapted for other regions, and the infrastructure is clearly built to scale.
Across these intrusions, the group draws on two kinds of tooling: well-known offensive utilities that any attacker might reach for, such as netcat
, fscan
, and pwnkit
, and a broad set of custom tools written by the operators themselves: a downloader, several backdoors, a credential stealer, and purpose-built reconnaissance scripts. The sections below focus on that custom toolkit, which is where the group’s tradecraft shows.
A downloader written in Go, referred to internally as DownPro. Its job is to pull the rest of the toolkit onto a freshly compromised host and launch it.
The binary is driven by a handful of flags, and a telling detail stands out immediately: their help strings are written in both English and Chinese. The flags are:
u
– URL of the main backdoor to downloadid
– URL of the ChUser payloadup
– URL of the unix_updates
payload (the PasswordHarvester)j
– offline URL encryptor mode: it takes a plaintext URL via u
and outputs the ciphertext to use as the flag value in real runslogs
– where to write logsThe values passed to these flags are AES-GCM encrypted with a hardcoded key and Base64-encoded, so the operator supplies pre-encrypted URLs at runtime rather than leaving them in the clear.
DownPro then decides where to drop its payload based on its effective UID, preparing two sets of candidate destination paths: one for root, one for non-root. Running as root, it selects one of:
/usr/local/bin/systemd-udevd
/usr/local/bin/rsync-tsl
/usr/local/bin/tcp-tsl
/usr/local/bin/snapd-ext
/usr/local/bin/fsck-disk
/usr/local/bin/nftables-init
These names are chosen to blend into a Linux server environment, either mimicking legitimate system components or looking like ordinary utility and network helpers. Running without root, it instead generates one of two temp-style names designed to pass as routine disk clutter:
/tmp/php_sess_<32_hex_chars>
– mimicking a PHP session file/tmp/private-tmp-<5_alnum_chars>
– looking like an ephemeral temp artifactWith the destination chosen, it downloads the file from the -u
URL and executes it with the argument -si
.
The two optional payloads are handled separately. When the -id
flag is set, DownPro downloads a file to /usr/bin/chuser
, sets its permissions to 0755
, changes its owner to root, and timestomps it to match /bin/ls
and turning it into a setuid helper that serves as a persistent local privilege-escalation backdoor. When the -up
flag is set, it downloads a file to /usr/sbin/unix_updates
and runs it with -v FuckMe#988
, then strips the setuid bit from /usr/bin/pkexec
.
A simple backdoor that masquerades as a chuser
utility. It executes commands passed through the -c
flag, but only after passing one of two activation checks:
curl
command using the -x
flag and runs it. Activation succeeds only if the command’s output matches the expected value, chuser no version
.-s
flag) with a hardcoded salt, FuCkMe#
, computes the MD5 of secret + salt
, and compares it against a hardcoded target hash. Activation succeeds only on a match.A credential stealer based on 3snake that monitors newly executed authentication programs, including sshd
, sudo
, su
, doas
, ssh
, ssh-add
, passwd
, kinit
, and login
.
On startup, it sets a clean PATH
environment variable and installs signal handlers so the daemon can log and exit cleanly. It runs only as root, exiting otherwise, and gates execution behind a covert activation switch: the CRC32 of the -v
argument must match a hardcoded value.
Once the CRC gate passes, the stealer resolves the host’s name and IPv4 addresses, then daemonizes by forking, calling umask(0)
so it can freely control file permissions, changing its working directory to /tmp
, and redirecting stdout and stderr to a file.
To hide itself, it picks at random from roughly 29 fake process names, such as:
[kworker/1:2]
[ksoftirqd/0]
[watchdog/0]
[systemd]
[dbus-daemon]
[journald]
[migration/0]
[ksmd]
It overwrites the original argv
with the chosen name and calls prctl
to change the kernel-visible task name to match.
The core logic then opens a netlink socket and subscribes to process events (PROC_CN_MCAST_LISTEN
). On every process execution or UID change event, it checks whether the process name or command line matches one of the target programs listed above. When a match falls outside the expected path prefixes, it enters the interceptor flow: it attaches to the target with ptrace
, reads the credential buffers, and exfiltrates them to its C2, RC4-encrypted and Base64-encoded.
A modular backdoor written in Go, built to land quietly, blend into a busy host, take orders over an encrypted channel, and hand its operator everything they need to work through a network.
On launch, AlphaAgent first checks whether it was invoked to finish an upgrade, so an in-progress self-update can complete cleanly. It then parses its command-line flags, validates its configured role and transport, and generates a Device ID from either the victim’s MAC address or the username combined with a hardcoded salt (e*f#1%0d$6&5=6
). After checking its debug flags (DEBUG
, VERBOSE
, or neither), it decrypts its configuration strings using AES-GCM with a hardcoded key.
[Figure 19 – Device ID generation](Gaming the system how a Chinese-speaking actor tur/image_(4)
The configuration holds the region blocklist, the transport role and mode, the C2 domain, the TLS SNI camouflage value used for the certificates, and the directory, filename, and loader names for the rootkit.
With its configuration in hand, the agent goes to ground. It renames its own process to pass as a kernel thread or a system daemon, choosing the disguise from its configuration profile and applying it by rewriting argv[0]
or calling prctl
. The profiles are:
/usr/sbin/amazon-master
or /usr/local/sbin/amazon-proxy
/usr/bin/google_user_agent
or /usr/bin/google_proxy_agent
rsyslogd
"dbus-daemon -n%d" "scsi_eh_%d" "[migration/%d]" "[cpuhp/%d]" "[kworker/u%d:1]" "[watchdog/%d]" "[kswapd%d]"
php-fpm: pool www
or nginx: worker process
.AlphaAgent then detaches into the background and writes a PID lock file under an innocuous path so that only one copy runs. It sleeps for a randomized interval which is long enough to outlast a quick sandbox detonation, and checks where it is running: if the host’s country matches the operators’ blocklist (China, in the samples we analyzed), the agent simply exits. Only after clearing that geofence does it enter its connect-and-retry loop and reach out to the server.
Finally, if the -r
flag is set at execution, AlphaAgent checks whether the rootkit’s kernel module is already loaded. If it is not, the agent installs it; the rootkit ships embedded inside the binary via Go’s embed.FS
API. In all the samples we analyzed, we haven’t found any rootkits, only placeholders.
Once connected, the agent enrolls, starts a heartbeat, and subscribes for jobs. How it talks to its server is a build-time choice, and each option is designed to look like something benign.
The primary channel is gRPC over HTTPS. The agent’s gRPC transport is built as a publish/subscribe service. The agent subscribes to receive jobs and publishes results back, and on top of that base, it opens dedicated streams for each interactive function rather than multiplexing everything through one pipe. There are separate streams for the web terminal, for uploads, for downloads, and for keepalive pings, and each exists in two directions an operator-facing set and an agent-facing set. That separation keeps a live terminal session responsive while a large file transfer runs in parallel.
Three design choices make this channel hard to spot on the wire:
api.google.com
as its server name, serves a .google.com
certificate, and dresses its HTTPS heartbeats as Google traffic with decoy cookies (NID
, SID
, and similar) plus a custom proof scheme carried in Cloudflare-style parameters (_cf_auth_ts
, _cf_auth_nonce
, _cf_auth_method
). The heartbeat side exposes handler paths like /agent/heartbeat
and /notifications/v1/push
to complete the illusion of a Google notification service.The Message fields of the communication:
Message Message field 1: string cid (label=optional) - connection ID field 2: string mid (label=optional) - Message ID field 3: int32 command (label=optional) - specific command to run field 4: bytes data (label=optional) - data for command field 5: string topic (label=optional) - channel name field 6: bytes encrypted_data (label=optional) - encrypted payload field 7: string sid (label=optional) - stream ID field 8: string file_name (label=optional) - if there is a file field 9: string file_action (label=optional) - can be upload / download / delete / list
The alternative channel is DNS. Here the same commands travel inside DNS queries: each job is encrypted, Base32-encoded, and split across DNS labels, then exchanged as TXT-style traffic on port 53. Many environments scrutinize outbound web sessions but wave DNS through, which is exactly the point. A separate variant of the toolkit keeps things simpler still, tunneling its protocol over a plain HTTP connection with certificate checks disabled.
The alternative channel is DNS. Here the same commands travel inside DNS queries: each job is encrypted, Base32-encoded, and split across DNS labels, then exchanged as TXT-style traffic on port 53. Many environments scrutinize outbound web sessions but wave DNS through which is exactly the point. A separate variant of the toolkit keeps things simpler still, tunneling its protocol over a plain HTTP connection with certificate checks disabled.
Whichever channel it uses, the agent bootstraps through public DoH and GeoIP providers such as Cloudflare, Google, ipinfo, and others, both to resolve its server and to run the geofence check described above.
At the center of the agent is a single job dispatcher. The server sends a numbered command; the dispatcher routes it to the matching handler. That design keeps the protocol compact and makes the feature set easy to summarize. The sections below cover the ones that matter most.
/bin/sh -c
, and the combined output is captured and returned to the operator. The agent takes care to keep this quiet. It sets HISTFILE=/dev/null
so commands leave no shell history behind. For interactive work, the agent goes beyond one-shot commands. It can allocate a real pseudo-terminal, launch a shell inside it, and stream that terminal to the operator as a browser-based “webtty” session. This gives an attacker a live, interactive shell with full terminal behavior, not just fire-and-forget commands, which is what you want for hands-on-keyboard operations.wtmp
, utmp
, and the system authentication logs, and enumerates current SSH sessions. It can then archive a victim’s .ssh
directory and .bash_history
into a compressed bundle for exfiltration. Read who logged in, grab their keys and history, and use the tunnel to reach the next host: the collection features are built to feed lateral movement, not just to profile a single machine. Worth flagging: the host inventory the agent sends home includes a virtualization role field, meaning the agent reports back whether it believes it is running inside a virtual machine or sandbox. That gives the operators a chance to abandon or lie low on analysis systems before doing anything noisy.ai_plugin_%s.sh
”, runs them and sends the result to the C2.[kworker/...]
, [kswapd...]
, nginx: worker process
, or rsyslogd
and overwrites its own command-line arguments so tools that read them see the disguise too. It suppresses its own output to /dev/null
and detaches as a daemon. Some builds go further and hide the process outright. On command, the agent can bind-mount over its own /proc
entry, making itself invisible to anything that reads the process table – a lightweight but effective trick that needs no kernel module. Other builds do carry a kernel-module component, controlled through custom device commands, that hides processes and network connections at the kernel level and can stage an additional loader fetched from the operator. The encrypted configuration and the traffic camouflage described earlier round out an evasion posture that spans disk, process table, and network. One variant is packaged to defeat analysis itself. It is wrapped in a protector that strips the file’s structure, unpacks the real payload only in memory, obfuscates its internals, and watches for a debugger, popping a decoy error and exiting the moment it detects one. Same feature set underneath, hardened against the analyst.The full list of commands:
| Command ID | Args | Description |
|---|---|---|
| 2 | server parameters | gRPC tunnel |
| 4 | server parameters | SocksProxy (using Ligolo-ng) |
| 8 | command string | shell command execution |
| 10 | path, recursive | file browser / directory listing |
| 12 | processname, argv_name | process name spoofing |
| 14 | strings of several commands | Multi command AUTOSTART |
| 16 | connection hide + remote install + streaming upload | |
| 18 | Install new Rootkit | |
| 20 | Uninstall rootkit | |
| 22 | unmount process – CommandRunUNINSTALL | |
| 24 | Http based file transfer | |
| 26 | gRPC file upload | |
| 28 | gRPC file download | |
| 30 | Tun socks relay start | |
| 32 | Tun socks relay stop | |
| 38 | Hide process via bind mount | |
| 40 | Get SSH and bash history | |
| 42 | System information collector | |
| 44 | Registration acknowledgement | |
| 46 | AI plugin execution | |
| 48 | Agent upgrade |
oRAT is a Go-based Linux remote access trojan built for full remote administration of a compromised host.
It starts with decrypting the configuration baked into the binary that contains: the C2 address, the install paths, the process disguise, and the hiding flags all live inside one encrypted blob and are only unpacked in memory.
Unless told to skip it, the agent then runs its preparation routine, and this is where most of the damage is done before any traffic leaves the box. It configures logging to /dev/null
by default, daemonizes, disables SELinux enforcement (setenforce 0
), installs itself to a persistent location, registers a service, writes a GUID, takes a file lock so only one copy runs, deletes its original on-disk copy if it was relocated, and optionally hides its own process. Only after all of that does it enter its main loop of communication.
The agent’s communication routine supports three transports, selected by config:
On top of whichever transport it picks, oRAT layers a multiplexed session and speaks HTTP through it. It uses a standard Go HTTP client, but rewrites the client’s dialer so every request is carried inside the established oRAT session instead of hitting the network directly. The agent registers with the server by posting a join request to /join
, then serves operator commands as REST-style routes over that same tunnel.
Because oRAT exposes its capabilities as HTTP routes, its feature set reads almost like API documentation. The operator API includes:
| Route | Capability |
|---|---|
/agent/info | Report host details (distribution, kernel, and more) |
/agent/ping | Liveness check |
/agent/exec | Run an operator-supplied command |
/agent/upload | Write an uploaded file to a chosen path |
/agent/download | Retrieve a file from the host |
/agent/screenshot | Capture and return a screen image |
/agent/zip · /agent/unzip | Archive or extract chosen paths |
/agent/portscan | Scan hosts and ports from the victim |
/agent/proxy | Open a SOCKS proxy through the host |
/agent/net | Forward a raw TCP connection to any target |
/agent/ssh | Reach an embedded SSH / SFTP server |
/agent/upgrade | Replace the running binary |
/agent/kill-self | Delete the agent and exit |
oRAT offers two paths to run commands, and the second is the more interesting.
The direct path is a command route that hands operator input to sh -c
and returns the output, standard RAT behavior.
The richer path is a fully embedded SSH server. oRAT builds its own SSH service into the agent, complete with a hardcoded RSA host key, password authentication, port-forwarding, and an SFTP handler. When an operator connects, the agent spawns an interactive shell: trying zsh
, then bash
, then sh
with proper pseudo-terminal handling. In practice, the operator gets a real SSH session and SFTP file access on the target, tunneled through the C2 channel rather than exposed on a listening port.
oRAT’s persistence is quiet and well chosen. It installs itself to /usr/local/bin/xtables-addons
and registers a systemd service named xtables-addons
, wired into the standard multi-user target so it starts on boot as root. xtables-addons
is a real netfilter/iptables extension package, so an administrator glancing at the process list or the service table sees what looks like legitimate firewall tooling. If the agent lacks the privileges for a system-wide install, it falls back to per-user persistence through a user service and a cron entry.
It also hides its identity in an unexpected place. The agent stores its GUID by appending a # GUID:
comment line to /etc/protocols
, a legitimate system file no one thinks to check. Its lock file sits at /tmp/.lock
.
The evasion posture is layered and Linux-native:
sshd: root@pts/0
, so it reads in the process table as an interactive root SSH session. One build reinforces this by spoofing its executable path as /usr/sbin/sshd
./proc/
entry, disrupting inspection of the running process through the proc filesystem./dev/null
unless a specific debug environment variable is set.Together, these span the process table, the filesystem, the security policy, and the kernel’s view of the process, a broad effort to make the agent hard to notice and harder to inspect.
An SSH credential-checking and brute-force utility. It reads target IP addresses (-f
flag), usernames (-u
flag), passwords (-p
flag), or pre-combined user:pass
pairs (-up
flag) from operator-supplied files, then attempts concurrent SSH logins against each target.
Successful credentials are printed and appended in plaintext to a local results file, res.txt
. The binary has no hardcoded C2 infrastructure or persistence mechanism and its sole purpose is credential access against remote SSH services.
In some of the attacks we observed a number of Bash scripts with Chinese-language comments used by the attackers.
The first, info.sh
, proceeds in four stages. It first pulls recent login activity to profile who uses the box. It then walks every user’s home directory, including root’s, to inventory .ssh
folders, flag any files containing private keys, and comb .bash_history
for sensitive commands involving SSH, SCP, database clients, cloud tooling, credentials, and kubectl
, a fast way to harvest reusable secrets and understand the victim’s workflows. The third stage is the most refined: a storage analysis that hunts for remote network mounts (NFS, CIFS/Samba, WebDAV, cloud FUSE) and Docker volumes while deliberately filtering out overlay, tmpfs, and container-ID noise, so the operator sees only genuine lateral-movement targets rather than local container clutter – a sign the author iterated on the tool to cut false positives. Finally, it gathers classic lateral-movement intelligence: /etc/hosts
entries, local listening TCP ports, and the ARP neighbor table to reveal adjacent hosts on the network.
The second script, findweb.sh
, surveys a compromised host’s web-server landscape and maps out every site it serves. It first detects which web servers are running (Nginx, Apache, or httpd) using several fallback methods, and extends the check to containerized deployments by inspecting Docker for web-server images and any containers publishing ports 80 or 443 to the host. Where possible, it reports the ports each server listens on. It then parses the server configurations directly: for Nginx it walks the common configuration directories, resolving symbolic links and de-duplicating by real path, then extracts each virtual host’s domain (server_name
), web root, and any proxy_pass
upstreams; for Apache and httpd it does the equivalent, pulling DocumentRoot
, ServerName
, and ServerAlias
from every VirtualHost
block across the standard Debian, RedHat, and common control-panel configuration paths.
The result is a concise inventory of every domain hosted on the machine, where each site’s files live on disk, and where any existing reverse-proxy rules already point. In the context of this campaign, that inventory is exactly what an operator needs to weaponize a compromised server: it reveals which trusted domains are available to abuse, the exact web roots to plant content in, and where to graft the malicious proxy module so that attacker pages are served under a legitimate site’s name.
We assess with medium-to-high confidence that Gambling Goblin is tied to Earth Berberoka – a Chinese-speaking threat cluster first documented by Trend Micro in 2022. Earth Berberoka is known for targeting online gambling platforms that serve Chinese-speaking users and operators, and for working across Windows, Linux, and macOS with a mix of aged commodity RATs and purpose-built tooling. Our assessment rests on three independent overlaps: the malware, the operator artifacts, and the network infrastructure.
Tooling. The group’s use of oRAT is the clearest link. oRAT was tied to Earth Berberoka in 2022, and the variant we analyzed shares the same orat/cmd/agent
codebase and REST-style operator routes. The connection extends to the group’s custom malware: one of the AlphaAgent samples we recovered was uploaded in the same archive as other tools previously attributed to Earth Berberoka, placing AlphaAgent directly alongside the group’s known toolset rather than merely resembling it.
Operator artifacts. The focus on the online gambling sector and the Chinese-language strings scattered across this campaign’s tooling (dual-language flag descriptions, Chinese script comments, and Chinese-language page artifacts) align with operator fingerprints seen in the group’s past campaigns.
Infrastructure. The group has a documented habit of registering domains that impersonate trusted platforms. Trend Micro reported github[.]wiki
as an Earth Berberoka domain while the infrastructure behind Gambling Goblin follows the same playbook: lookalike domains such as github[.]la
and gitlab[.]bet
closely mirror that tradecraft. Reinforcing the link, many of the C2 servers in this campaign are hosted on the same Amazon ASN (AS16509) the group has relied on before.
This campaign marks a shift in who targets Brazil, and why. For years, the threats facing Brazilian users came mostly from home grown banking trojan crews. Brazil is a natural target for this kind of operator. It has become one of the world’s fastest-growing online-betting markets, with a vast base of mobile users accustomed to installing apps on the spot, which is exactly the audience a gambling-driven fraud operation wants to reach. For a Chinese-speaking group that has spent a decade monetizing the gambling sector, the money now runs through Brazil, and the infrastructure to exploit it is often trusted but under-secured. A vast base of mobile users conditioned to install apps on sight, and a sprawl of trusted but under-secured web servers, most of them on government .gov.br
domains whose search reputation is exactly what a large-scale SEO-fraud operation needs. Compromise those servers, graft on a malicious Apache module, and the attacker turns a nation’s legitimate infrastructure into a distribution network for gambling pages and fake app stores. That is the notable part: this is not opportunistic crime but patient, industrialized abuse of reputation, and it is run with espionage-grade Linux tooling in the service of financially motivated fraud, blurring the line between cybercrime and APT.
We expect the operation to grow rather than fade. The same infrastructure that inflates search rankings today is one configuration change away from serving malware tomorrow: the phishing pages already impersonate Google Play, the Microsoft Store, and Amazon, putting the operators a single step from pushing malicious apps straight to Brazilian victims. The Vietnamese, Spanish, and English pages we uncovered show the model is being exported, and the daily domain generators show it is built to scale. Countries should expect more of this, aimed higher, not only at customers and banking credentials, but at the government institutions whose domains lend the campaign its trust. None of it depends on novel exploits. It runs on unpatched internet-facing services, weak SSH credentials, and Apache modules that no one thinks to watch. If organizations, and public-sector operators in particular, do not close those gaps – patching exposed services, auditing Apache and SSH configurations, and hunting for rogue modules and masqueraded processes, then this actor and the wider wave of global cybercrime it represents, will keep finding an open door.
Hashes: 232ef6be134c2b7c14648aa193daf7e23e987477b8a40150dd77883947fdf017 088d0742a667f1acfc83edb94671a10b951f6745badec6d5c754ef594dddf815 88544d36beb6dc621c9376806836d0ad109ece64b589605d5674e0c86313d1c0 9d3085eac9a59a94f0473db5ec0173def8777d2f794da281fb1749389ae33cdb 263c14e84398339b25cd3e59da7e108340306fdbb8112bbe7dc0f07a71eb8a31 12af9d95c44e20a375148c25f8a2978a62ee95489134654c3537ccfb2d42120d 5af1bec4635e52da4909bf744ea4b7e4483ec944241218855212f4a9e3d48611 e8bb763bd10e727228ca9a8e3e6cf10bf4de4639b6be680a3abfb181a0adc052 fa7fc029ac13af2f3880151e9c408e9afadeba7b2cff01659806fb7c3c83288d c3c09fe219e10808f053e580628aeb87b1f00fc683c810aa828905fe03cda98f 2567d6b42dac97a391217ad22ee375f504d541940d3fbb9436a3f5e9bb23ab91 1829efbf7946e1a958779a3e7f1e50ca63fe61c6a2ddc177c14a7b0c5e10020a f025520d648c7799ca5bed4a9be5bee14ac33be1f1e9b20c090c8c6319404fcf 5a11ed7931fb6358846e0f3c8d69921f43f8ccade5937fc41e5c262cc49f82e8 0d4a28d5cf7b99f11ffe972abd0284d9e35b6858eeb288532a55633b3e29f9c7 5f6d112637545a2e8c1a9f260c39698852c7a22e83db5ccfc99b99d9f6274710 c4d2efa57eef0c5defc4ca708ebe35832f8b543cf764beebef56fef6d36d4f69 c3c6ab58514cd13638cf049332186ef6d4ec7b256913edb1cd66a19437608882 582ecca146a6aef478706e4b2774d6115a9220a18d1db8f92ee54a5118ecebd9 3a8f464f1f2b5c38173e2a96f95a690af327d85c13c04d37cf0a91893d487bdb 02f5e07dd4c97a3de48cc886f46dad35443f1c221a352630e2c7787806ee21b6 16d35a725819142d2bd5bc0949dc518d344d6f63626a517e67fcba7322eb3844 a71498bfffae8ac694356b3f2436820b396946c9e71c8915e282c1b2fdba4162 d138d5f4fbc77650bc3be1cbf8fbd0ee292aa30eed5feec1ea7ba02e57da932b 44373953431d7570d9585c91377dbe8b6527ccc00662d249f383b003b68b459f 45b9382d7e91a4178b47c908b9b5f6884de7c5a1ef849fbf01d6c23d06d81b88 1eb40363a64e0cad15e340af476d106ccf57ebb6662c1389da1347429ee68c9c fc789397742aee60b01292b071f79b4165981c31aa431eb1577a47c5911381c3 adbee84e9a43949b0a816f052ffb3c0b7855e078b985fea95532158c3b9389bc 0f26e1ba39ddd1f0a7e6f72bd8c4e02a5f0140de72eeda9fe5ab56402821e31e ab7d531d298f0d77bc7bbbdc36f4f8a1732ceca90ff60e3f225a99b9b10f334e ac99754357bd4a69c1de576977e0ee19c7354f29f7f52a9893b7a60f9c2f5248 94aa88ff6222583b2a5b791ddd655837787e31f59483ed91f860857d3399b84a 3ad35ea116b2c0855c13459a04699318b3944762385e8a47144f1d03b48f0bb1 0611c153bf8b8561ef53f2a5ba1413115bdc0e4554e0c22cf9641bd8845db03e 114824bccfafcbb42040f119fdcd3ec48f54eb154ffee6676d06986cba2b0af0 297c53d935c501864e15fe7abcfdafed83df9aafdf241094604ae405529c5eb7 0963c0034a5e0665729d686d50c5375948c4a684c56770adb13d24ff5df8013d 749784fb7846bb3b52dd8c2f660b53d95d5df30387b87b65b584ef9cc781ae52 8495598b1fec814d72caf76f1460b132071bb7305335331fed3bac9876c6e40c 98e17fe36ff77106bbbb9a04f3e00004bf872b88aab22438076966913ea83322 bcd7e5964630c34f06a43e48d696d99d7abae6b679509ad839ffa5179a972838 24f7296ac5ce844678c5f7470eaf64b28e870108ca06851c8f66a27a52003f12 2de964314a8aacc40897140f6fe21d268e24503a69f9821177e31bca7b1e4035 52863d36a216a86b2f90914db2d9229cba7ea317ab5ee9a678cb229087f04611 9d513a419bf129a42017b29eb7d084451a4f34be0828f6871439ec79f7f9b5fb d478f867512e18d839180ceafc980c8fb26c3aa7d1c9e96d054819c81afef6f4 b88a7f3288bdf4b97d75dad4e47e5cb3d4e0962b12674a08e32e5f96e762e877 f4aceaf5c0740093f8040f5e0f29c7582a1bd7ab2bca628d162fb45c29045063 2305ae23ea350e31b05b9f071d315ee60c5a88e96ce11be8ff9db16314a6197c 99b5404df81992cad104dd242bc736d75fd6c58af34dc1a75a8ee3c5e1784fa4 85b5e95cbb5103202abebf8f84b91a286994e61b33ddef53355ab0df2a2b6d9a cff25a9c84c893e32a9a75c1dae385934cf917f709efa11172a53ea2337fa109 154c977a113ff4d94ff2f29f7b93a8d0bd6ad8e67a820c09505117f5d386fd40 67ccc12c0a17dc31388a8c851d076edaaf1213e80398b01d46f5a29b8c7b8b9b e8bc706b0b007d6a122c6b19e87451e550baee793540774db13b9a08803ed76a f32dfbe4a2c11a975d735297bf76f6497ce9f5789ab8eaaef3fdd182c2f1f7b1 c59ebe5cf45935c7b5f91b5936fe2c8a5feb7ca161e40ca4e3fb93e447373fa6 3537bfeaf2c18feafeaf773700a88118fd50979d97f2c42c7e34ba6c9aa62820 2949f0b16b83b35dc8a3dfa11815b9516403e3997e13100e7b86f3bb81f6c283 0e7c96a22e3612c68866a8693cc583df95972d3444978ce163c024a45682133a 7d9f5eb3f704607e6f63681842f48071cc58f2f2e63b16b64a49440cb4b9e6e3 8a64d368ce14c5a1f5e775714bcc02f080d0541360743bb4235e0d640f1787b1 36cf87fe2e29cc8b0fd84fce91d70e62a4c4d2fc5f9650dc37440d629ae61b8f 090e886e5605255ad5708e1f27aecc54319de835abd28853e54182981410707e fa7d8c44a0ecb5ec40832d0d2cfe22c47879317177eae88d178e156f1c8d61a3 d948b486c740b66642a5ae29dc1cb80da703ad40296bcda34a1b27216b63a5cd 612fe3a3ace706725aa5415a1cd1cf18548627b4b40636c5443cb770def30b4c 96488c59287889fcd3b9952ec78b78914fabb901c8b61a7354552439170ed148 Domains: rb[.]aliyuntsl[.]com br[.]team-c2[.]com hwlocal[.]team-hw[.]com br[.]team-hw[.]com data[.]mirrors-inc[.]com team-hw[.]com update[.]team-c2[.]com devops[.]aliyuntsl[.]com bageyi[.]kernel-lib[.]com 8yiu[.]kernel-lib[.]com dnslog[.]kernel-lib[.]com js[.]ai-jquery[.]com api[.]onlinevrgame[.]com file[.]ijjjst23m[.]com kerneltty[.]com 80[.]443[.]team up[.]443[.]team 404[.]443[.]team data[.]windows-update-cdn[.]com microsoft-azure-loadbalance[.]com update[.]aliyun[.]la api[.]gitlab[.]bet github[.]la update[.]opentls2[.]com IPs: 154[.]84[.]62[.]160 154[.]84[.]62[.]128 154[.]84[.]62[.]149 154[.]84[.]62[.]145 15[.]228[.]251[.]82 56[.]124[.]87[.]60 18[.]229[.]255[.]14 18[.]166[.]208[.]57 18[.]228[.]136[.]28 43[.]198[.]248[.]193 43[.]199[.]133[.]195 18[.]166[.]243[.]179 18[.]164[.]116[.]24 13[.]203[.]9[.]172 43[.]198[.]30[.]170 18[.]162[.]210[.]53 56[.]125[.]218[.]234 18[.]228[.]195[.]216 56[.]124[.]49[.]89 54[.]207[.]196[.]189 165[.]22[.]101[.]200 172[.]80[.]8[.]202 104[.]206[.]37[.]134 108[.]187[.]28[.]158 202[.]146[.]222[.]18 192[.]253[.]229[.]23 16[.]162[.]255[.]92 13[.]250[.]18[.]158 18[.]163[.]182[.]231 204[.]16[.]172[.]106