Chinese network hacks '.gov.br' websites in online betting fraud.

A report by Check Point Research (CPR), authored by researcher Amit Yardeni, revealed that a Chinese-speaking cybercriminal group—dubbed "Gambling Goblin" and linked to the "Earth Berberoka" cluster, already associated with attacks on the gambling sector in Asia—is hacking into Brazilian public agency servers to boost an international online gambling scheme, according to a report by TecMundo.

What the report shows

According to CPR, the group compromises servers with the .gov.br domain — among the identified targets are a ministry, a federal public agency, a legislative assembly, state audit courts, and dozens of municipalities — and uses them to manipulate Google search results. Users who click on these results are redirected to fake pages that mimic major app stores, such as Google Play, Microsoft Store, and Amazon, but which in practice promote online and sports betting.

The campaign has been monitored by CPR since mid-2025 and already has variations in Vietnamese, Spanish, and English, with an automated system that generates new domains daily to circumvent blocks.

When asked what can be done about this type of hijacking of official domains, the general manager of CERT.br, Cristine Hoepers, was direct: "there is nothing that Registro.br can do in these cases." The problem, according to her, lies in the configuration of the compromised servers themselves — a security flaw, not something that the domain registry can prevent.

What TecMundo has learned most recently

TecMundo's report contacted the Institutional Security Office of the Presidency (GSI/PR) and obtained the government's official response to the case. According to the agency, the Government's Center for Prevention, Treatment and Response to Cyber ​​Incidents (CTIR Gov) did not receive any notification of data leaks involving citizens or civil servants linked to the events described in the CPR report. The GSI also clarified that the technical correction is the responsibility of each affected agency—CTIR Gov's role is limited to providing technical guidance at the beginning of the process, as attributing the authorship of an attack to a specific group depends on correlating different technical and intelligence elements.

The report also presents two pieces of data that help to illustrate the scale of the problem: most of the incidents cited by Check Point occur in city halls, and this type of hijacking of servers to manipulate searches had already prompted a recommendation from CTIR Gov itself in 2024 — in other words, the government was already aware of the vulnerability before this episode became public.

Another point highlighted by the report is the use of artificial intelligence by criminals to automate stages of the attack, and the information that Brazil appears as the main market for scammers at the moment — which reinforces the interpretation that the country is now a priority, and not incidental, target for this type of operation focused on gambling.

The reading that we do

This case is a relevant piece of evidence for a debate that frequently resurfaces: the feasibility of banning online casino gambling in Brazil.

If the Brazilian state cannot protect its own official infrastructure — .gov.br domains, with all the institutional authority they carry — from being hijacked by an international network of illegal gambling, it is reasonable to question the enforcement capacity of any prohibition that depends on blocking bettors' access to platforms outside the national regulatory perimeter.

It's important to emphasize: the CPR report documents a phishing fraud and SEO manipulation—it doesn't measure bettor flow or prove migration to illegal operators. The connection to the ban debate is our editorial interpretation based on the facts, not a finding of the report. But the logic is straightforward: in the event of a ban on online casino betting, bettors don't stop wanting to bet—they lose access to the regulated, supervised, and taxed market in Brazil, and become natural candidates for absorption by illegal operators, including the same Chinese groups that this report shows already operate with technical sophistication and international reach over the Brazilian public.

If the government cannot prevent its own official website from being used to promote illegal gambling, the question remains: with what instrument does it intend to prevent gamblers from migrating to these same networks if the regulated market is shut down?