The detection guidance says most of what you need to know about how hard this is to find. Check Point tells defenders to audit installed Apache modules for unexpected .so files, especially ones timestamped to match legitimate modules such as mod_ssl or mod_suexec [12]. Matched timestamps defeat the usual first pass, which is sorting the module directory by modification date. What is left is diffing the loaded module list against the package manager's manifest on every public web host, which is inventory work most public-sector estates have not done once, let alone continuously.
The second signal is path-scoped. CPR says a sudden absence of Content-Security-Policy headers on specific URL paths is a strong indicator of injected reverse-proxy behaviour [13]. Specific paths is the operative phrase. The root of the site keeps its headers and its real content, while a chosen path proxies attacker-controlled phishing pages with no foreign domain in the browser bar [4]. Reputation feeds, TLD allowlists and root-URL crawlers all evaluate the domain, and the domain is a real government domain, held by real federal, state and municipal institutions [3]. Blocking therefore has to be per-URL or not at all, and taking a state agency host offline in a web filter carries its own bill.
The borrowed trust runs further than the compromised hosts themselves. App tiles and navigation links on the phishing pages point to dozens of genuine domains, the majority of them impersonating legitimate .gov.br sites [10]. Search ranking is the product; the gambling and sports betting traffic is the revenue [6].
On portability, Check Point found the same template already localised for Vietnamese, Spanish and English-speaking audiences, with infrastructure generating fresh domains daily [9]. Counting Brazil's Portuguese deployment, that is four language markets running off one template [18].
Separate the attribution from the telemetry. The tie to Earth Berberoka, a cluster previously documented against Asian gambling sites, rests on infrastructure overlap that includes a shared Amazon ASN previously linked to that group, plus generated domains traced back to Chinese-language gambling and adult-content sites [8][16]. Check Point presents that as overlap. It is not a confession, and no host count is published: the writeup says "many" .gov.br sites and "dozens" of referenced domains [19].
The detail I would weight over the SEO fraud: alongside the proxy modules, the same intrusions deploy a Linux toolkit with several backdoors, a credential stealer and a reconnaissance agent for mapping internet-facing infrastructure [7]. The betting redirect is the part a visitor sees. Check Point also notes the pages already imitate Google Play, Microsoft Store and Amazon closely enough that one configuration change would serve apps instead of bets [11].
