MALICIOUS APACHE MODULES HIJACK BRAZILIAN GOVERNMENT SITE TRAFFIC TO PUSH BETTING PAGES

Summary from the TLDR InfoSec newsletter

Gambling Goblin installed malicious Apache modules on Brazilian government and education servers. The modules reverse-proxy visitors to fake Google Play, Microsoft Store, and Amazon pages promoting betting sites. Operators deployed DownPro, AlphaAgent, oRAT, 3snake, SSH brute-forcing, and reconnaissance tools. Administrators lack published module hashes, filenames, or paths for direct Apache checks.