For more than a year, the Chinese-language group known as Gambling Goblin has compromised Brazilian government servers, using the high reputation of the domains to boost the search-engine rankings of the group's phishing sites.
The attacks focus on creating a reverse-proxy network to boost the legitimacy of gambling-oriented phishing sites, increasing the sites' rankings on search engines, according to a new report from Check Point Software Technologies. The group has compromised about 30 servers in Brazil, mainly belonging to local governments and education organizations, with a handful of companies affected as well.
While the cybercriminal group deploys Apache modules and Linux tools to compromised servers to build the proxy network, the concern is that the network could easily be used to push malware or further compromise connected networks, says Pedro Drimel Neto, malware analyst team leader at Check Point Software.
"Essentially, they can turn this infrastructure into anything they want at any given time," he says. "They can even allow it to download malware at some point because the infrastructure has already been created."