Reported by 2 outlets
Earth Berberoka-Linked Hackers Target Brazil With Linux Malware and SEO Poisoning
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Earth Berberoka-Linked Hackers Target Brazil With Linux Malware and SEO Poisoning
gbhackers.com · 40d ago · September 3rd, 2026
A Chinese-speaking cybercrime cluster linked to the Earth Berberoka threat actor has compromised Brazilian government and educational web servers to conduct large-scale SEO poisoning and online-gambling fraud. The operation has been active since mid-2025 and represents a notable shift in Brazil’s threat landscape. Rather than deploying the country’s more familiar banking malware, the attackers are […] The post Earth Berberoka-Linked Hackers Target Brazil With Linux Malware and SEO Poisoning appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Hackers Hijack Brazilian Government Websites to Manipulate Search Results
cyberpress.org · 40d ago · September 3rd, 2026
Cybercriminals have compromised Brazilian government websites and turned them into hidden platforms for phishing pages, gambling promotions, and search-engine manipulation. Researchers at Check Point Research linked the activity to a Chinese-speaking threat group believed to be connected to Earth Berberoka, a cluster previously known for targeting online gambling operations in Asia. Instead of defacing sites or displaying obvious malicious content, the attackers quietly modify web-server behavior. This lets them use trusted Brazilian government domains to host attacker-controlled pages without immediately alerting administrators or visitors. The goal appears to be large-scale SEO abuse . By serving content from reputable .gov.br websites, the attackers can make malicious pages appear more trustworthy to search engines and users. The tactic may help fraudulent gambling pages rank higher in search results and attract traffic from people looking for legitimate apps or online services. Brazil Government Websites Hijacked The attackers deploy custom Apache modules on compromised servers. These modules act as secret reverse proxies, meaning that selected requests to the real government website are silently forwarded to attacker infrastructure. Researchers observed the modules reacting to specific URL paths , including /wps , /bmw , and /card . Infection chain (Source: checkpoint) When a visitor ope