Gambling Goblin Malicious Apache Modules: Detecting and Removing Rogue mod_*.so Backdoors on Linux Web Servers

---
title: Apache HTTP Server Spawning Shell or Unusual Child Process
id: 3f9c1a72-4b8e-4d2a-9c15-7e6f0a1b2c3d
status: experimental
description: Detects the Apache worker process spawning shells or interpreters, consistent with a malicious Apache module executing attacker commands in-process. Legitimate Apache workers should almost never exec shells on servers without CGI/PHP-FPM exec patterns.
references:
  - https://thehackernews.com/2026/09/malicious-apache-modules-hijack.html
  - https://attack.mitre.org/techniques/T1505/004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Legacy CGI applications executing system commands
  - mod_php applications calling exec()/shell_exec()
level: high
---
title: Suspicious Shared Object Written to Apache Module Directory
id: 8b2d4e61-1c3f-4a58-b7d9-2e4a6c8f0d1e
status: experimental
description: Detects file creation of shared objects in Apache module directories by processes other than the system package manager. Malicious Apache modules are staged as .so files in /etc/httpd/modules, /usr/lib64/httpd/modules, or /usr/lib/apache2/modules.
references:
  - https://thehackernews.com/2026/09/malicious-apache-modules-hijack.html
  - https://attack.mitre.org/techniques/T1505/004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.004
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/etc/httpd/modules/'
      - '/usr/lib64/httpd/modules/'
      - '/usr/lib/apache2/modules/'
      - '/usr/lib/httpd/modules/'
  selection_ext:
    TargetFilename|endswith: '.so'
  filter_package_managers:
    Image|endswith:
      - '/dpkg'
      - '/apt'
      - '/apt-get'
      - '/rpm'
      - '/yum'
      - '/dnf'
      - '/unattended-upgrade'
  condition: selection_path and selection_ext and not filter_package_managers
falsepositives:
  - Administrators manually compiling and installing third-party Apache modules (e.g., mod_pagespeed builds)
level: high
---
title: LoadModule Directive Added to Apache Configuration
id: 5c7a9f13-6d24-4e8b-a3c7-9f1b2d4e6a80
status: experimental
description: Detects modification of Apache configuration files where LoadModule directives are defined, by editors or scripts outside expected configuration-management tooling. Gambling Goblin-style persistence requires registering the rogue module in httpd.conf, apache2.conf, conf.modules.d, or mods-enabled.
references:
  - https://thehackernews.com/2026/09/malicious-apache-modules-hijack.html
  - https://attack.mitre.org/techniques/T1554/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1554
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/etc/apache2/apache2.conf'
      - '/etc/apache2/mods-enabled/'
      - '/etc/httpd/conf/httpd.conf'
      - '/etc/httpd/conf.modules.d/'
      - '/etc/apache2/conf-enabled/'
  filter_mgmt:
    Image|endswith:
      - '/dpkg'
      - '/apt'
      - '/rpm'
      - '/dnf'
      - '/yum'
      - '/ansible-playbook'
      - '/ansible'
      - '/puppet'
      - '/chef-client'
  condition: selection and not filter_mgmt
falsepositives:
  - Administrators editing Apache config via vi/nano (tune with authorized admin accounts or a change-window allowlist)
level: medium

// Hunt: Apache worker spawning shells/interpreters or downloads (malicious module behavior)
let lookback = 14d;
Syslog
| where TimeGenerated > ago(lookback)
| where ProcessName in~ ("apache2", "httpd")
    or SyslogMessage has_any ("apache2", "httpd")
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "python", "perl", "curl", "wget", "nc ")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
| order by TimeGenerated desc;
// Hunt: auditd records showing writes to Apache module/config paths by non-package tools
Syslog
| where TimeGenerated > ago(lookback)
| where SyslogMessage has_any ("/etc/httpd/modules", "/usr/lib64/httpd/modules", "/usr/lib/apache2/modules", "conf.modules.d", "mods-enabled")
| where SyslogMessage has_any ("open", "creat", "rename", "write") or ProcessName in~ ("cp", "scp", "rsync", "curl", "wget", "vi", "nano")
| where SyslogMessage !has_any ("dpkg", "apt", "rpm", "dnf", "yum")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;
// Hunt: HTTP redirects to gambling-themed external domains in proxy/WAF logs (CommonSecurityLog via CEF)
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where DeviceVendor in~ ("Apache", "Squid", "Zscaler", "Palo Alto Networks") or AdditionalExtensions has "Referer"
| where DestinationHostName has_any ("bet", "casino", "slot", "gambl", "aposta", "jogos") // includes Portuguese 'aposta' (bet)
    and RequestMethod == "GET"
| summarize Hits = count(), SrcHosts = dcount(SourceHostName) by DestinationHostName, RequestURL, bin(TimeGenerated, 1h)
| order by Hits desc;

-- Hunt for rogue Apache modules: enumerate .so files in module dirs,
-- flag those NOT owned by the package manager, plus unexpected LoadModule lines.
-- Deploy as a client artifact across Linux web servers (via Linux.Sys or custom collection).

LET module_dirs = ("/etc/httpd/modules/", "/usr/lib64/httpd/modules/", "/usr/lib/apache2/modules/", "/usr/lib/httpd/modules/")

LET rogue_modules = SELECT FullPath, Mtime, Size,
    shell(argv=["bash", "-c", format(format="rpm -qf %s 2>/dev/null || dpkg -S %s 2>/dev/null || echo NOT_PACKAGE_OWNED", args=FullPath, args=FullPath)]).Stdout AS PackageOwner
FROM glob(globs=module_dirs + "*.so")
WHERE PackageOwner =~ "NOT_PACKAGE_OWNED"
   OR Mtime > now() - 90 * 24 * 3600  -- recently modified modules

LET suspicious_loadmodule = SELECT FullPath, Line,
    parse_records_with_regex(regex="^LoadModule\\s+(?P<Module>\\S+)\\s+(?P<Path>\\S+)", buffer=Line).Path AS ModulePath
FROM parse_lines(filename=glob(globs=(
    "/etc/apache2/apache2.conf",
    "/etc/apache2/mods-enabled/*.load",
    "/etc/httpd/conf/httpd.conf",
    "/etc/httpd/conf.modules.d/*.conf")))
WHERE Line =~ "^LoadModule"
    AND NOT Line =~ "mod_(access_compat|alias|auth|autoindex|cgi|deflate|dir|env|expires|filter|headers|http2|log_config|mime|negotiation|proxy|reqtimeout|rewrite|setenvif|socache|ssl|status|unixd|version|mpm_prefork|php)"

SELECT * FROM rogue_modules
UNION ALL
SELECT FullPath, NULL AS Mtime, NULL AS Size, suspicious_loadmodule.Line AS PackageOwner, NULL AS Line, NULL AS ModulePath
FROM suspicious_loadmodule

#!/bin/bash
# Gambling Goblin-style rogue Apache module audit
# Run as root. Safe: read-only checks, no changes made.

echo "=== [1] Modules currently loaded in Apache ==="
apachectl -M 2>/dev/null | sort | tee /tmp/loaded_modules.txt

echo; echo "=== [2] Verify every .so in module dirs is owned by the package manager ==="
MODDIRS="/usr/lib64/httpd/modules /usr/lib/apache2/modules /etc/httpd/modules"
for d in $MODDIRS; do
  [ -d "$d" ] || continue
  for so in "$d"/*.so; do
    [ -e "$so" ] || continue
    if command -v rpm >/dev/null 2>&1; then
      owner=$(rpm -qf "$so" 2>/dev/null)
    else
      owner=$(dpkg -S "$so" 2>/dev/null)
    fi
    if [ -z "$owner" ] || echo "$owner" | grep -qi "no path\|not owned"; then
      echo "SUSPICIOUS (not package-owned): $so"
      sha256sum "$so"
      stat -c '  mtime: %y | uid: %U' "$so"
    fi
  done
done

echo; echo "=== [3] All LoadModule directives (diff against your CM baseline) ==="
grep -rEi '^\s*LoadModule' /etc/apache2 /etc/httpd 2>/dev/null

echo; echo "=== [4] Recently modified files in Apache config/module paths (last 30 days) ==="
find /etc/apache2 /etc/httpd /usr/lib64/httpd/modules /usr/lib/apache2/modules \
  -type f -mtime -30 2>/dev/null -exec ls -la {} \;

echo; echo "=== [5] Apache processes with open outbound sockets ==="
for pid in $(pgrep -x apache2; pgrep -x httpd); do
  ss -tanp 2>/dev/null | grep "pid=$pid" | grep -v ':80 \|:443 '
done | sort -u

echo; echo "=== [6] Search access logs for redirect responses to gambling terms (pt/en) ==="
grep -rEi ' 30[1278] ' /var/log/apache2/ /var/log/httpd/ 2>/dev/null | \
  grep -Ei 'bet|casino|slot|aposta|jogos|gambl' | tail -50

echo; echo "Done. Investigate any SUSPICIOUS .so, unknown LoadModule, or gambling redirects immediately."