TLDR Tech / InfoSec
Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages
The "Gambling Goblin" group installed malicious Apache modules on Brazilian government and education servers, redirecting visitors to fake Google Play, Microsoft Store, and Amazon pages that promote betting sites. The attackers used tools such as DownPro, AlphaAgent, oRAT, 3snake, SSH brute-forcing, and reconnaissance tools. Administrators currently lack published module hashes, filenames, or paths, making direct Apache checks difficult.
Read the full story