Gaming the System How a Chinese-Speaking Actor Turned Brazil...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://research.checkpoint.com/2026/gaming-the-system-how-a-chinese-speaking-actor-turned-brazilian-government-sites-into-an-seo-weapon
• Blog Title: Gaming the System: How a Chinese-Speaking Actor Turned Brazilian Government Sites into an SEO Weapon
• Suggested Section: Network Services Pentesting > 80,443 - Pentesting Web Methodology > Apache, with cross-references from Linux Hardening > Post-Exploitation and Processes/Systemd for malicious Apache modules, ptrace credential interception, procfs process hiding, and tunneled pivoting

🎯 Content Summary

Campaign overview, access, and impact
Check Point Research documents Gambling Goblin, a Chinese-speaking cybercrime cluster assessed with medium-to-high confidence to be connected to Earth Berberoka. Since mid-2025, the actor has compromised primarily Brazilian government and educational Linux web servers and converted their trusted domains into reverse-proxy and content-injection infrastructure for gambling-related SEO poisoning. Parallel campaigns use Port...

🔧 Technical Details

Trusted-origin reverse proxy: After obtaining root access to an Apache host, an attacker can compile and install a custom module with apxs and register it at the name-translation stage. Selected URI prefixes can be rewritten to attacker-controlled upstreams while the browser retains the legitimate hostname. Forwarding the original Host header makes the upstream request plausible. Removing build artifacts and copying timestamps from legitimate Apache modules helps the rogue module blend into the installation.

Server-side CSP removal: A malicious web-server module can remove the site's original Content-Security-Policy before the response reaches the browser and replace it with a policy allowing inline scripts, dynamic evaluation, third-party assets, data:, and blob:. This is not a browser-side CSP parser bypass; control of the server response eliminates the defense and permits attacker-controll...

🤖 Agent Actions

Implemented the HackTricks update in:

• src/network-services-pentesting/pentesting-web/apache.md

  • Malicious Apache DSO deployment with apxs
  • Trusted-origin reverse proxying
  • Output-filter injection and server-side CSP removal
  • Module/package integrity auditing
  • Differential detection of SEO cloaking

• src/linux-hardening/post-exploitation/linux-post-exploitation/README.md

  • Netlink-triggered ptrace credential interception
  • Audit and live-response commands
  • /proc/<pid> masking through bind mounts
  • Mount-namespace-aware detection

Added numbered references to Check Point Research, 3snake, Apache documentation, and ptrace(2).

Validation completed:

• git diff --check passed
• Markdown fences are balanced
• Referenced URLs returned HTTP 200
• No forbidden sources were added
• mdbook was unavailable in the environment, so a full build could not be run

Existing Ligolo/tunneling and process-name masquerading coverage was not duplicated.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://research.checkpoint.com/2026/gaming-the-system-how-a-chinese-speaking-actor-turned-brazilian-government-sites-into-an-seo-weapon

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting > 80,443 - Pentesting Web Methodology > Apache, with cross-references from Linux Hardening > Post-Exploitation and Processes/Systemd for malicious Apache modules, ptrace credential interception, procfs process hiding, and tunneled pivoting".

Repository Maintenance:

• MD Files Formatting: 998 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0