Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
126 IOCs
Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon
Threat Actors
Malware Families
Excerpt
Research by: Amit Yardeni Key Points A Chinese-speaking actor is now targeting Brazil. Check Point Research has uncovered a sustained campaign against Brazilian organizations, primarily government and educational institutions since mid-2025. We dubbed this group Gambling Goblin: a Chinese-speaking cybercrime cluster connected to a previously documented group, Earth Berberoka, that targeted gambling sites across Asia. It marks a shift from Brazil’s usual home-grown…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability(3)
Victim
Indicators of Compromise
Open the mindmap →126 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | b88a7f3288bdf4b97d75dad4e47e5cb3d4e0962b12674a08e32e5f96e762e877 | Medium | Score 58/100 | First seen |
| IP | 16.162.255.92 | Low | Score 31/100 | First seen |
| SHA256 | 94aa88ff6222583b2a5b791ddd655837787e31f59483ed91f860857d3399b84a | Medium | Score 53/100 | First seen |
| SHA256 | cff25a9c84c893e32a9a75c1dae385934cf917f709efa11172a53ea2337fa109 | Medium | Score 53/100 | First seen |
| Domain | microsoft-azure-loadbalance.com | High | Score 58/100 | First seen |
| SHA256 | 297c53d935c501864e15fe7abcfdafed83df9aafdf241094604ae405529c5eb7 | Medium | Score 42/100 | First seen |
| SHA256 | 0611c153bf8b8561ef53f2a5ba1413115bdc0e4554e0c22cf9641bd8845db03e | Medium | Score 42/100 | First seen |
| IP | 54.207.196.189 | Low | Score 31/100 | First seen |
| Domain | js.ai-jquery.com | High | Score 58/100 | First seen |
| SHA256 | c3c6ab58514cd13638cf049332186ef6d4ec7b256913edb1cd66a19437608882 | Medium | Score 58/100 | First seen |
| IP | 165.22.101.200 | High | Score 58/100 | First seen |
| IP | 204.16.172.106 | Low | Score 38/100 | First seen |
| SHA256 | 2de964314a8aacc40897140f6fe21d268e24503a69f9821177e31bca7b1e4035 | Medium | Score 42/100 | First seen |
| IP | 202.146.222.18 | Medium | Score 45/100 | First seen |
| SHA256 | 0d4a28d5cf7b99f11ffe972abd0284d9e35b6858eeb288532a55633b3e29f9c7 | Medium | Score 63/100 | First seen |
| SHA256 | ab7d531d298f0d77bc7bbbdc36f4f8a1732ceca90ff60e3f225a99b9b10f334e | Medium | Score 53/100 | First seen |
| IP | 172.80.8.202 | Medium | Score 64/100 | First seen |
| Domain | github.wiki | High | Score 68/100 | First seen |
| SHA256 | 154c977a113ff4d94ff2f29f7b93a8d0bd6ad8e67a820c09505117f5d386fd40 | Medium | Score 53/100 | First seen |
| Domain | dnslog.kernel-lib.com | High | Score 67/100 | First seen |
| IP | 154.84.62.145 | Medium | Score 62/100 | First seen |
| SHA256 | 9d513a419bf129a42017b29eb7d084451a4f34be0828f6871439ec79f7f9b5fb | Medium | Score 53/100 | First seen |
| SHA256 | 114824bccfafcbb42040f119fdcd3ec48f54eb154ffee6676d06986cba2b0af0 | Medium | Score 42/100 | First seen |
| SHA256 | 52863d36a216a86b2f90914db2d9229cba7ea317ab5ee9a678cb229087f04611 | Low | Score 33/100 | First seen |
| IP | 43.198.30.170 | Low | Score 31/100 | First seen |
| IP | 15.228.251.82 | Low | Score 31/100 | First seen |
| Domain | gitlab.bet | High | Score 58/100 | First seen |
| SHA256 | 1829efbf7946e1a958779a3e7f1e50ca63fe61c6a2ddc177c14a7b0c5e10020a | Medium | Score 42/100 | First seen |
| SHA256 | c4d2efa57eef0c5defc4ca708ebe35832f8b543cf764beebef56fef6d36d4f69 | Medium | Score 58/100 | First seen |
| IP | 56.124.49.89 | Low | Score 31/100 | First seen |
| SHA256 | 0e7c96a22e3612c68866a8693cc583df95972d3444978ce163c024a45682133a | Medium | Score 53/100 | First seen |
| IP | 104.206.37.134 | Medium | Score 64/100 | First seen |
| SHA256 | f025520d648c7799ca5bed4a9be5bee14ac33be1f1e9b20c090c8c6319404fcf | Medium | Score 63/100 | First seen |
| IP | 18.229.255.14 | Low | Score 31/100 | First seen |
| Domain | 80.443.team | High | Score 58/100 | First seen |
| IP | 13.203.9.172 | Low | Score 31/100 | First seen |
| SHA256 | d138d5f4fbc77650bc3be1cbf8fbd0ee292aa30eed5feec1ea7ba02e57da932b | Medium | Score 63/100 | First seen |
| SHA256 | 090e886e5605255ad5708e1f27aecc54319de835abd28853e54182981410707e | Medium | Score 42/100 | First seen |
| SHA256 | 749784fb7846bb3b52dd8c2f660b53d95d5df30387b87b65b584ef9cc781ae52 | Low | Score 33/100 | First seen |
| SHA256 | 44373953431d7570d9585c91377dbe8b6527ccc00662d249f383b003b68b459f | High | Score 67/100 | First seen |
| Domain | api.onlinevrgame.com | High | Score 58/100 | First seen |
| IP | 108.187.28.158 | Medium | Score 42/100 | First seen |
| SHA256 | 85b5e95cbb5103202abebf8f84b91a286994e61b33ddef53355ab0df2a2b6d9a | Medium | Score 53/100 | First seen |
| SHA256 | 12af9d95c44e20a375148c25f8a2978a62ee95489134654c3537ccfb2d42120d | Medium | Score 63/100 | First seen |
| SHA256 | 612fe3a3ace706725aa5415a1cd1cf18548627b4b40636c5443cb770def30b4c | Medium | Score 58/100 | First seen |
| Domain | devops.aliyuntsl.com | High | Score 67/100 | First seen |
| SHA256 | e8bc706b0b007d6a122c6b19e87451e550baee793540774db13b9a08803ed76a | Medium | Score 53/100 | First seen |
| SHA256 | 1eb40363a64e0cad15e340af476d106ccf57ebb6662c1389da1347429ee68c9c | Medium | Score 58/100 | First seen |
| SHA256 | 232ef6be134c2b7c14648aa193daf7e23e987477b8a40150dd77883947fdf017 | Medium | Score 42/100 | First seen |
| Domain | file.ijjjst23m.com | High | Score 67/100 | First seen |
| SHA256 | 2949f0b16b83b35dc8a3dfa11815b9516403e3997e13100e7b86f3bb81f6c283 | Medium | Score 53/100 | First seen |
| IP | 43.199.133.195 | Low | Score 31/100 | First seen |
| IP | 154.84.62.128 | Medium | Score 64/100 | First seen |
| SHA256 | 5af1bec4635e52da4909bf744ea4b7e4483ec944241218855212f4a9e3d48611 | Medium | Score 53/100 | First seen |
| SHA256 | c59ebe5cf45935c7b5f91b5936fe2c8a5feb7ca161e40ca4e3fb93e447373fa6 | Medium | Score 53/100 | First seen |
| SHA256 | 88544d36beb6dc621c9376806836d0ad109ece64b589605d5674e0c86313d1c0 | Medium | Score 53/100 | First seen |
| SHA256 | fa7d8c44a0ecb5ec40832d0d2cfe22c47879317177eae88d178e156f1c8d61a3 | Low | Score 33/100 | First seen |
| IP | 43.198.248.193 | Low | Score 31/100 | First seen |
| SHA256 | c3c09fe219e10808f053e580628aeb87b1f00fc683c810aa828905fe03cda98f | High | Score 67/100 | First seen |
| Domain | bageyi.kernel-lib.com | High | Score 58/100 | First seen |
| SHA256 | ac99754357bd4a69c1de576977e0ee19c7354f29f7f52a9893b7a60f9c2f5248 | Medium | Score 53/100 | First seen |
| IP | 56.125.218.234 | Low | Score 31/100 | First seen |
| Domain | playfootball.info | High | Score 58/100 | First seen |
| SHA256 | e8bb763bd10e727228ca9a8e3e6cf10bf4de4639b6be680a3abfb181a0adc052 | Medium | Score 58/100 | First seen |
| SHA256 | 3537bfeaf2c18feafeaf773700a88118fd50979d97f2c42c7e34ba6c9aa62820 | Medium | Score 42/100 | First seen |
| IP | 18.164.116.24 | Low | Score 28/100 | First seen |
| IP | 18.228.136.28 | Low | Score 31/100 | First seen |
| SHA256 | 7d9f5eb3f704607e6f63681842f48071cc58f2f2e63b16b64a49440cb4b9e6e3 | Low | Score 33/100 | First seen |
| Domain | rb.aliyuntsl.com | High | Score 58/100 | First seen |
| SHA256 | 2305ae23ea350e31b05b9f071d315ee60c5a88e96ce11be8ff9db16314a6197c | Medium | Score 58/100 | First seen |
| SHA256 | 088d0742a667f1acfc83edb94671a10b951f6745badec6d5c754ef594dddf815 | Medium | Score 42/100 | First seen |
| IP | 18.166.208.57 | Low | Score 31/100 | First seen |
| SHA256 | 02f5e07dd4c97a3de48cc886f46dad35443f1c221a352630e2c7787806ee21b6 | High | Score 67/100 | First seen |
| Domain | data.mirrors-inc.com | High | Score 58/100 | First seen |
| IP | 13.250.18.158 | Low | Score 31/100 | First seen |
| Domain | hwlocal.team-hw.com | High | Score 58/100 | First seen |
| IP | 18.163.182.231 | Low | Score 31/100 | First seen |
| SHA256 | 45b9382d7e91a4178b47c908b9b5f6884de7c5a1ef849fbf01d6c23d06d81b88 | Medium | Score 53/100 | First seen |
| SHA256 | 96488c59287889fcd3b9952ec78b78914fabb901c8b61a7354552439170ed148 | Medium | Score 53/100 | First seen |
| SHA256 | 5a11ed7931fb6358846e0f3c8d69921f43f8ccade5937fc41e5c262cc49f82e8 | Low | Score 33/100 | First seen |
| SHA256 | bcd7e5964630c34f06a43e48d696d99d7abae6b679509ad839ffa5179a972838 | Low | Score 33/100 | First seen |
| Domain | team-hw.com | High | Score 69/100 | First seen |
| SHA256 | d948b486c740b66642a5ae29dc1cb80da703ad40296bcda34a1b27216b63a5cd | Medium | Score 53/100 | First seen |
| Domain | update.aliyun.la | High | Score 58/100 | First seen |
| SHA256 | adbee84e9a43949b0a816f052ffb3c0b7855e078b985fea95532158c3b9389bc | Medium | Score 53/100 | First seen |
| Domain | data.windows-update-cdn.com | High | Score 58/100 | First seen |
| SHA256 | 16d35a725819142d2bd5bc0949dc518d344d6f63626a517e67fcba7322eb3844 | High | Score 67/100 | First seen |
| IP | 154.84.62.160 | Medium | Score 64/100 | First seen |
| Domain | 8yiu.kernel-lib.com | High | Score 67/100 | First seen |
| Domain | 404.443.team | High | Score 58/100 | First seen |
| Domain | br.team-hw.com | High | Score 58/100 | First seen |
| SHA256 | 263c14e84398339b25cd3e59da7e108340306fdbb8112bbe7dc0f07a71eb8a31 | Medium | Score 53/100 | First seen |
| IP | 18.228.195.216 | Low | Score 31/100 | First seen |
| SHA256 | 3a8f464f1f2b5c38173e2a96f95a690af327d85c13c04d37cf0a91893d487bdb | Medium | Score 53/100 | First seen |
| SHA256 | 582ecca146a6aef478706e4b2774d6115a9220a18d1db8f92ee54a5118ecebd9 | Medium | Score 58/100 | First seen |
| SHA256 | 9d3085eac9a59a94f0473db5ec0173def8777d2f794da281fb1749389ae33cdb | Low | Score 33/100 | First seen |
| SHA256 | 2567d6b42dac97a391217ad22ee375f504d541940d3fbb9436a3f5e9bb23ab91 | Medium | Score 58/100 | First seen |
| SHA256 | 24f7296ac5ce844678c5f7470eaf64b28e870108ca06851c8f66a27a52003f12 | Medium | Score 42/100 | First seen |
| SHA256 | 3ad35ea116b2c0855c13459a04699318b3944762385e8a47144f1d03b48f0bb1 | Medium | Score 42/100 | First seen |
| Domain | kerneltty.com | High | Score 58/100 | First seen |
| SHA256 | fa7fc029ac13af2f3880151e9c408e9afadeba7b2cff01659806fb7c3c83288d | Medium | Score 53/100 | First seen |
| Domain | github.la | High | Score 69/100 | First seen |
| SHA256 | 98e17fe36ff77106bbbb9a04f3e00004bf872b88aab22438076966913ea83322 | Low | Score 33/100 | First seen |
| SHA256 | 67ccc12c0a17dc31388a8c851d076edaaf1213e80398b01d46f5a29b8c7b8b9b | Medium | Score 53/100 | First seen |
| Domain | update.opentls2.com | High | Score 58/100 | First seen |
| SHA256 | 0963c0034a5e0665729d686d50c5375948c4a684c56770adb13d24ff5df8013d | Medium | Score 42/100 | First seen |
| Domain | br.team-c2.com | High | Score 58/100 | First seen |
| SHA256 | 0f26e1ba39ddd1f0a7e6f72bd8c4e02a5f0140de72eeda9fe5ab56402821e31e | Medium | Score 53/100 | First seen |
| Domain | update.team-c2.com | High | Score 58/100 | First seen |
| SHA256 | 8a64d368ce14c5a1f5e775714bcc02f080d0541360743bb4235e0d640f1787b1 | Medium | Score 43/100 | First seen |
| SHA256 | f32dfbe4a2c11a975d735297bf76f6497ce9f5789ab8eaaef3fdd182c2f1f7b1 | Medium | Score 53/100 | First seen |
| SHA256 | 99b5404df81992cad104dd242bc736d75fd6c58af34dc1a75a8ee3c5e1784fa4 | Medium | Score 53/100 | First seen |
| IP | 56.124.87.60 | Low | Score 31/100 | First seen |
| SHA256 | f4aceaf5c0740093f8040f5e0f29c7582a1bd7ab2bca628d162fb45c29045063 | Medium | Score 58/100 | First seen |
| SHA256 | 5f6d112637545a2e8c1a9f260c39698852c7a22e83db5ccfc99b99d9f6274710 | Medium | Score 58/100 | First seen |
| IP | 154.84.62.149 | Medium | Score 62/100 | First seen |
| IP | 18.162.210.53 | Low | Score 31/100 | First seen |
| SHA256 | fc789397742aee60b01292b071f79b4165981c31aa431eb1577a47c5911381c3 | Medium | Score 53/100 | First seen |
| Domain | api.gitlab.bet | Medium | Score 47/100 | First seen |
| IP | 192.253.229.23 | High | Score 86/100 | First seen |
| SHA256 | 36cf87fe2e29cc8b0fd84fce91d70e62a4c4d2fc5f9650dc37440d629ae61b8f | Medium | Score 42/100 | First seen |
| IP | 18.166.243.179 | Low | Score 28/100 | First seen |
| Domain | up.443.team | High | Score 58/100 | First seen |
| SHA256 | d478f867512e18d839180ceafc980c8fb26c3aa7d1c9e96d054819c81afef6f4 | Medium | Score 58/100 | First seen |
| SHA256 | a71498bfffae8ac694356b3f2436820b396946c9e71c8915e282c1b2fdba4162 | Medium | Score 53/100 | First seen |
| SHA256 | 8495598b1fec814d72caf76f1460b132071bb7305335331fed3bac9876c6e40c | Low | Score 33/100 | First seen |
IOC Relationship Graph
Building graph…