02-09-2026
Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon
https://research.checkpoint.com/2026/gaming-the-system-how-a-chinese-speaking-actor-turned-brazilian-government-sites-into-an-seo-weapon/
Report completeness: High
Actors/Campaigns:
Gambling_goblin
Earth_berberoka
Threats:
Orat_rat
Downpro
3snake_tool
Naabu_tool
Nuclei_tool
Subfinder_tool
Cloaking_technique
Netcat_tool
Fscan_tool
Pwnkit_tool
Pkexec_tool
Yamux_tool
Ligolo-ng_tool
Hideprocess_tool
Victims:
Government, Education, News media, Healthcare, Business associations
Industry:
Healthcare, Entertainment, Government, Financial
Geo:
Brazilian, Chinese, Portuguese, Spanish, Brazil, Hong kong, Asia, China, Vietnamese
TTPs:
Tactics: 5
Technics: 0
IOCs:
File: 2
Domain: 27
IP: 30
Hash: 69
Soft:
Google Play, Microsoft Store, Linux, Twitter, curl, sudo, php-fpm, nginx, SELinux, systemd, have more...
Algorithms:
base32, md5, crc-32, base64, aes-gcm, zip, rc4
Win API:
FS
Languages:
javascript, golang, php
Links:
https://github.com/blendin/3snake