Hacking Campaign and SEO Cloaking of Indonesian Illegal Gambling

Online gambling in Indonesia is a billion-dollar illegal industry. Data from the Indonesian Financial Transaction Reports and Analysis Centre (INTRAC/PPATK) shows that online gambling in Indonesia generated Rp286.84 trillion in fund circulation, equivalent to about US$16 billion, in 2025.

Among Indonesia's population of approximately 280 million, about 1 in every 23 people deposited money into an online gambling platform. Addictive game mechanics and systems designed in favor of operators turn promises of quick returns into repeated losses. The resulting financial distress contributes to crime and broader social harm.

Operators in Indonesia and other countries, including Thailand, Cambodia, and China, compete for Indonesian users. From October 2024, when Indonesia's current government took office, through July 2026, the Ministry of Communication and Digital Affairs acted against approximately 3.7 million gambling sites and content items while law enforcement carried out arrests and related operations.

Enforcement and competition have pushed operators toward Black Hat SEO and SEO Cloaking for more sustainable advertising and operations. They hack vulnerable websites, inject gambling pages designed to rank for selected queries, show search-optimized content to crawlers, and redirect visitors to domains under their control.

Cybercrime-as-a-Service and Online Gambling Marketing

Our researchers were involved in incident response and technical analysis for several high-profile Indonesian institutions whose websites were hacked to promote online gambling. Despite promoting different brands, the attackers used similar tactics, techniques, and procedures (TTPs), suggesting the use of Cybercrime-as-a-Service for illegal online marketing.

Indonesian government and public institution websites have been frequent hacking targets for two decades. Attackers previously used their access mainly for web defacement and occasionally for more serious objectives such as data theft. In recent years, demand for online gambling promotion has created more opportunities to monetize that access by turning hacked websites into marketing infrastructure.

In these campaigns, attackers use trusted domains they have hacked to promote gambling content through Search Engine Optimization (SEO). SEO shapes how content is discovered and positioned in search results. This unauthorized manipulation is a form of Black Hat SEO.

As recently as July 2026, Indonesian police arrested a hacker accused of using Black Hat SEO on Indonesian websites to promote online gambling and earning hundreds of millions of rupiah. Similar groups have also been arrested previously, some of which earned billions of rupiah.

Methods used across hacking campaigns may vary, but findings from the websites and servers we analyzed provide insights into how attackers use trusted domains to increase traffic to illegal online gambling platforms.

SEO Cloaking

SEO Cloaking is a Black Hat SEO technique that serves search crawlers different content from what other visitors receive. When a request matches Googlebot or another crawler, the hacked website returns HTML built around targeted marketing keywords.

In these campaigns, injected pages target queries such as slot, gacor, and specific gambling brand names for indexing by the crawler. Gambling brands can therefore appear in search results under trusted domains without exposing the advertisement to every visitor.

The use of hacked websites for illegal marketing injection has been documented since the early years of search engines. SEO Cloaking itself has become more prominent over the past five years. In 2022, Wiz documented related cloaking and redirection campaigns across East Asian websites, including campaigns promoting gambling.

Successful campaign methods from other countries spread to Southeast Asia. Over the past four years, SEO Cloaking for online gambling has drawn growing interest in Black Hat SEO and underground hacking forums, including discussions focused on the Indonesian market.

Trusted domains such as .go.id can rank prominently for users in Indonesia and continue generating impressions until the webmaster removes the injected pages. Hackers can charge per website, delivered traffic, or placement duration. They may also sell monthly placements across collections of hacked domains.

Compared with obvious web defacement or visible page and keyword injection, SEO Cloaking is harder to detect. It can remain active longer and generate more profit for hackers and illegal gambling operators.

AMP Abuse

SEO Cloaking serves the manipulated HTML only to crawlers, but advertisers need visibility beyond the search result itself. Attackers use AMP to deliver the gambling content to users who click the result.

AMP, originally Accelerated Mobile Pages, allows a website owner to provide a separate HTML version that a CDN or search engine such as Google can cache and display instead of the original page. When configured, clicking the search result can open the cached AMP version. Despite the word Mobile in its original name, the AMP cache can also be served to desktop users.

When injecting code into a website page, attackers can add or replace its AMP version with a page hosted at an external URL under their control. After reindexing, the search engine caches the AMP page, and the search result opens that cache containing the gambling advertisement.

This mechanism can preserve legitimate search results and content for queries unrelated to gambling and for direct visits. Normal HTML is returned when the website is inspected through a browser, which can mislead administrators and security analysts.

We found many cases where attackers configured AMP only for mobile view. Desktop users who click the same search result still receive the normal page without the AMP cache. This further reduces suspicion when administrators or analysts inspect the search result only from a desktop view.

Initial Access

Many institutional websites in Indonesia are written in PHP and are often not properly secured. PHP also gives attackers greater flexibility when application files or directories are writable because they can inject code simply by adding or modifying a file.

Initial access followed patterns common to other web hacking campaigns. Many victims were low-hanging fruit whose exposed vulnerabilities could be exploited trivially, including through mass automated scanning.

• In cases we handled, the affected websites included WordPress installations with a history of vulnerable plugins and internally developed applications with insecure file-upload functions that enabled remote code execution.
• Some websites were reached through lateral movement from other vulnerable websites or servers.
• In one case involving a website on a local VPS, evidence showed potential malicious access through the QEMU Guest Agent. This suggests that the hosting provider's VM host serving this particular victim may also have been hacked.
• Outside our engagements, we also observed a substantial number of victim websites using common web platforms such as WordPress and Open Journal Systems (OJS), which may have contained exploitable vulnerabilities at the time of intrusion.
• Also outside our engagements, we observed credentials for institutional administration portals exposed in infostealer logs available on the dark web. Attackers could reuse these credentials for initial access.

The vulnerability may have been exploited and initial access established long before the observed campaign. Relevant historical logs can provide evidence of the entry path. Without them, the current state of a website or server may no longer reflect the conditions under which the attacker gained access.

Among Cybercrime-as-a-Service providers offering Black Hat SEO, we also observed web shell or command-and-control (C2) access from earlier hacks being sold or reused to provide instant access.

Regardless of the entry path, attackers need command execution or arbitrary file-write capability to inject code.

Persistence

Persistence Overview

Attackers established persistence to retain access and modify hacked websites over time. Persistent access kept advertisements online and allowed attackers to replace them when needed.

The extent and duration of persistence varied. In one case we handled, access persisted for at least nine months, with different online gambling brands injected at different times.

The persistence methods depended on the application and level of access.

• On WordPress websites, attackers placed malicious files that loaded wp-load.php and authenticated the current session as an existing administrator. This provided access to the administration panel without creating or modifying a user account.
• Attackers added or modified files across WordPress directories, including /mu-plugins, /wp-content/themes, /wp-content/plugins, and /wp-includes.
• Customized, obfuscated PHP web shells disguised as legitimate files appeared on both WordPress and non-WordPress websites. Some contained comments in Indonesian and attribution to Indonesian threat actors.
• Malicious persistence code was designed to evade common web shell scanners such as Wordfence, ImunifyAV, and Maldet. It avoided obvious patterns such as eval, used common WordPress core functions, loaded payloads in stages, and concealed payloads inside image files or PHP files themselves.
• We also found a simple PHP uploader left by the attacker that may have been used to upload additional malicious PHP files as needed.
• When PHP used disable_functions to restrict command execution, attackers attempted to bypass it with public exploits targeting outdated PHP releases.
• Host-level methods included a fake sudo wrapper for credential theft, overriding SSH configuration, adding SSH private keys, and a Remote Access Trojan (RAT) launched through .bashrc, Cron, or systemd. When root access was available, the RAT could also run with root privileges.

Attackers often adjusted their persistence to what was possible on each server. Non-obvious mechanisms and defense evasion helped it survive basic administrator checks.

Remote Access Trojan

Across every victim we analyzed, attackers deployed the same RAT based on GSocket. This popular tool is commonly used by hackers for persistence.

GSocket connects the victim to the attacker's command-and-control (C2) server through the Global Socket Relay Network using a shared secret key. The encrypted communication allows the attacker to send shell commands to the victim's server.

For some reasons, attackers always stored the RAT binary and secret key under /home/[user]/.config/htop/ with the same defunct base name. The binary was named defunct, while the key was stored as defunct.dat. The same paths and names have appeared in many other hacking campaigns, indicating the use of a shared hacking kit.

To make the RAT persist, attackers configured multiple execution paths.

• Attackers modified the local user's .bashrc to launch the RAT whenever the user opened a shell session, such as through SSH.
• Cron was also configured to execute the RAT at set intervals.
• Systemd was used to start the RAT at boot and restart it when terminated.

In the .bashrc and Cron configurations, attackers concealed the command with Base64 and used exec -a to disguise the process name. Observed names resembled Linux kernel threads or system services, including [kaluad], [kswapd0], [kworker], [kstrp], [watchdogd], and [slub_flushwq].

Administrators should verify suspicious processes through procfs instead of trusting displayed names. For each process ID (PID), /proc/<PID>/exe points to the executable being run and /proc/<PID>/cmdline contains its command-line arguments. Numeric PID directories under /proc can be iterated to inspect all running processes.

Auditd SYSCALL and EXECVE records can also support the investigation when process-execution auditing was enabled and the relevant logs remain available.

The RAT connected outbound to attacker-controlled infrastructure over TCP port 443. Using the standard HTTPS port made the connection resemble normal encrypted web traffic, although the protocol was not HTTPS and carried malicious C2 communication.

Other victims and campaigns may use different malware, file locations, or persistence methods. These findings describe recurring and reusable techniques observed in the analyzed cases.

Privilege Escalation

Local Root Privilege Escalation

We observed persistence running as root even though initial access typically did not give attackers direct root access. The attackers therefore performed privilege escalation.

In one case, evidence showed that the attacker stole the password of a local user with sudo access and used it to become root. In other cases, incomplete logs prevented us from determining the exact privilege-escalation method, although we found potential privilege-escalation paths in system scripts.

Multiple Linux privilege-escalation CVEs were also published during the persistence period, and the attackers may have used one of them.

In the password-theft case, the attacker intercepted sudo with a malicious Bash wrapper at /home/[user]/.local/bin/sudo. The user's .bashrc placed $HOME/.local/bin before system directories in PATH, causing the shell to resolve the wrapper when the user ran sudo.

The wrapper imitated the legitimate password prompt. When a local user ran sudo, the wrapper sent the username, password, and host details to an attacker-controlled Telegram destination before running the actual sudo.

Once root access was available, attackers installed the same GSocket RAT at /usr/bin/defunct. A systemd unit named defunct.service launched the RAT at boot and restarted it when the process stopped.

Potential Virtualization Host Compromise

In one case, we found evidence that the attacker executed commands through the QEMU Guest Agent on a server hosted by a local VPS provider. This indicated a possible compromise of the hosting company's virtualization host or management plane serving that victim.

We could not determine whether the attacker gained access through a known VM escape vulnerability in an outdated QEMU deployment or lateral movement within the hosting environment. We had neither access nor authorization to investigate the provider's servers. We notified the hosting provider of the finding.

Compromise of web-hosting infrastructure is less common than hacking individual websites or VMs, but hosting-level compromise is not new. Historically, threat actors have gained access to hosting providers in Indonesia through known VM escape vulnerabilities, compromised hosting management panels, and social engineering of hosting administrators.

Lateral Movement

The business model of Cybercrime-as-a-Service providers specializing in website abuse depends on gaining access to as many websites as possible. Apart from exploiting vulnerabilities directly, attackers can use access to one victim to reach additional websites and servers.

In the cases we analyzed, we found evidence of several potential paths for lateral movement. These included SSH access from affected servers to other machines using stored private keys, access to other websites hosted on the same server, and compromised cloud or server-management API keys.

The QEMU Guest Agent activity described in the previous section may represent another path through provider-side virtualization infrastructure.

Incomplete logs often prevented full reconstruction of the lateral movement paths. Analyzing an affected server from an offensive security perspective can still identify plausible routes, but without supporting evidence, they remain hypotheses.

Evidence Tampering

We found possible attempts to tamper with evidence, but the behavior was inconsistent and did not appear in every case.

Observed activity included the removal of entries from web server access logs, SSH or authentication logs, Bash history files, and Auditd logs. Correlation with other logs also indicated that some malicious files had been removed.

We also found that attackers often operated outside business hours in Indonesia, including late at night, on weekends, and during public holidays. This gave them time to tamper with local evidence before administrators noticed the activity. Logs forwarded in near-real time to a separate, synchronized system could retain records later removed from the affected server.

Across the cases, we also observed attackers modifying mtime to conceal malicious files. This timestamp records the last content modification. Attackers backdated malicious files to match surrounding files in the same directory.

A malicious file added to a WordPress theme directory had the same modification time as legitimate theme files. The RAT under /usr/bin used a timestamp from years earlier, making it appear to be part of an older installation.

Because ls displays mtime by default, investigators should use stat to compare it with ctime and btime. In the stat output, ctime records the last inode or status change, while btime records the original file creation time.

Action on Objectives

SEO Code Injection

Attackers injected SEO code to place hacked websites in search results for gambling queries and direct search users to advertisements controlled by the operator. In most cases, they focused on Google.

They commonly avoided changing the main index file. On WordPress websites, they used Must Use Plugins under /mu-plugins, active themes, plugins, or WordPress core files. On other PHP websites, they modified shared includes, application components, or framework files loaded with each request. Some injections were distributed across multiple files, making complete removal harder.

The injected PHP checked the visitor's User-Agent for Googlebot and other crawlers. In some samples, a broad crawler filter was followed by a Google-specific filter, so only Googlebot received the special content. Matching requests received different HTML containing the AMP configuration. Other visitors received the legitimate website.

We found no evidence that the code validated the source IP against Googlebot ranges or performed similar network checks. A request from any network could receive the injected content when its User-Agent matched the filter.

The attackers may not have considered IP validation necessary or may have avoided it because Googlebot addresses change. Future variants may add this validation to restrict payload delivery and make dynamic analysis harder.

The mechanism concealed the advertising content while directing relevant search users to it.

• Users searching Google for terms such as slot, gacor, or specific gambling brands would find a hacked website based on the content served to the crawler.
• Searches for normal terms or legitimate content associated with the victim could still return the original website.
• Opening the hacked result from a gambling-related search could take the visitor to the AMP cache containing the gambling advertisement instead of the original page.
• Attackers could configure the AMP flow only for mobile users or include both mobile and desktop users.
• Direct visits and visits through legitimate search results could still show the original page without the injected content.

Online Gambling Advertisement

AMP was central to the SEO Cloaking flow we observed because it delivered the gambling advertisement to search engine users while the original website continued to appear normal to its administrators and legitimate visitors.

The campaign advertised gambling platforms whose own domains may not be indexed by Google. Attackers relied on AMP as a landing page and could change the AMP content and destination when a gambling domain was blocked or when the service moved to another brand or operator.

The crafted SEO content followed a consistent pattern. Titles and summaries named the advertised gambling brand and included multiple gambling keywords in Indonesian.

The AMP pages often used festive content and attractive promotional images that were clearly AI-generated, with prominent links directing visitors to the operator's main gambling domain.

We found that many AMP pages were hosted on Cloudflare Pages, possibly because it offered free and flexible deployment through either free pages.dev subdomains or custom domains.

We also found cases where AMP pages were hosted on other hacked domains. Some of those AMP pages were also indexed by search engines.

Google Search Console Takeover

Google Search Console shows how a website appears and performs in Google Search. Attackers can use unauthorized access to review indexed queries, impressions, and clicks, request indexing, and confirm that SEO Cloaking and AMP pages are working as intended.

Attackers can verify themselves as site owners by placing a unique verification file on the hacked website or injecting a Google site-verification meta tag into its HTML.

Search performance metrics also have commercial value. Cybercrime-as-a-Service providers can report the traffic and keyword performance to their clients, justify service fees, and negotiate higher payments.

Disruptive Actions

In a small subset of cases, attackers performed full web defacement or deleted the website files. Their motives were unclear. Possible explanations include disputes within the operation, commercial conflict, or frustration when the campaign failed to achieve the expected SEO performance.

In another case, attackers replaced an apparently unmaintained website with a full-page gambling advertisement. The lack of maintenance may have made the website suitable for content intended to remain online for an extended period.

These actions made the hack easier to detect and differed from the concealment used in SEO Cloaking. We observed them only in a small subset of the campaigns.

Hacked Websites as Advertising Engines

Search data from one victim's website recorded 4.5 million impressions and 150,000 clicks from gambling-related queries during approximately three months of compromise in 2026.

The data contained these ten most common general gambling queries.

1. slot gacor
2. gacor
3. situs gacor
4. link gacor
5. link slot
6. situs slot
7. link slot gacor
8. slot gacor maxwin member baru
9. slotgacor
10. slot gacor hari ini

The popularity of these general search terms on Google in Indonesia rose sharply in 2025 before falling in 2026. The decline may reflect interventions by Google and Indonesian authorities to remove search results.

This suppression pushed Black Hat SEO operators to prioritize distinctive brand names that do not rely on generic terms. Operators have used this approach since at least 2020, with its use intensifying in recent years to build awareness of brand names and encourage users to search for them.

Advertisers use distinctive brand names such as TOTO***, SLOT***, and ***BET. They spread these names across YouTube, Instagram, Facebook, and TikTok through hundreds or thousands of spam accounts, dedicated advertising accounts, and paid influencers.

In some cases, they wrote brand names in spam posts using heavily stylized Unicode characters, such as 𝑺𝓛𝕺𝙏***, to preserve the visual brand while evading simple keyword matching and potential spam filters. They also attracted views by sending expensive gifts during popular TikTok livestreams.

Once users recognize a brand, they search for it on Google and encounter multiple hacked websites positioned for the same keyword. These websites direct search traffic to the operator. When authorities block the main gambling domain, the operator can redirect existing brand searches to a replacement domain and retain its visibility in search results.

Technical and Social Impact

The impact of this hacking campaign can be viewed from three perspectives.

First, the campaign damages the reputation of affected organizations and weakens public trust. When an official domain appears in gambling-related search results, the organization can look negligent or associated with illegal promotion.

The damage can continue after technical cleanup because public perception has already been shaped by the incident. Many reputable institutions have fallen victim in recent years, and many of their websites still appeared in gambling-related results at the time of writing.

Second, illegal online gambling creates broader social harm, with hacked infrastructure serving as both a catalyst and part of its supporting ecosystem. In Indonesia, it has damaged lives and families while contributing to related crime. Gambling-related financial distress has been linked to robbery and severe stress.

Third, hacked websites and servers create second-order technical risk because attackers can reuse them for campaigns with different objectives.

While some affected websites only publish articles and have limited functionality, others are government information systems that contain sensitive and valuable data. Lateral movement from one website can also reach other systems, including internal enterprise networks, and enable large-scale data exfiltration, ransomware, intelligence operations, or other digital crimes.

Detection and Recovery Opportunity

Site owners should register their domains in Google Search Console, confirm ownership, and review the users and owners listed under Settings. This provides a baseline for monitoring SEO integrity. Some SEO injections may not target Google, but Google Search Console should still be the primary tool for reviewing the website's search integrity.

Unexpected gambling queries in Insights or Search results performance can indicate a hack even when the website appears normal. The Test Live URL feature in Google Search Console can be used to emulate Googlebot crawling and indexing for inspection, and may expose the injected HTML.

Inspecting website files, logs, system files, runtime behavior, and network activity can identify indicators of compromise and determine the required recovery actions. Attackers sometimes also leave traces that provide clues to their online presence or even their real identities.

A fresh installation can restore the website from backup, but it needs to be handled with care because the backup may contain persistence mechanisms or vulnerable entry points that can be exploited again.

Long-term risk reduction depends on good engineering and security practices. These include well-managed web development and maintenance, a controlled DevOps pipeline, secure configuration, containerization, security monitoring and protection, and continuous vulnerability validation.

AI-Assisted Analysis and Recovery

Current AI models and agentic workflows can assist administrators with limited security expertise in identifying malicious changes and performing recovery. They can also review website files and system state before they are used in a fresh installation or post-incident migration. Their use should be carefully controlled to avoid unintended changes.

AI agents that communicate directly with a model server through a local session should never run on the compromised server.

The agent should run on a separate computer and work from a copy of the website files, preferably with a full server image. If it must execute commands on the compromised server, it should connect through a constrained intermediary such as SSH MCP, with every action planned and reviewed before execution.

Results vary with the model, reasoning intensity, prompt, and available context. Useful input context includes known-good website files for integrity comparison and relevant logs for tracing suspicious activity. At the time of writing, GPT-5.6-sol and Opus 5 are among the most capable models for this use case.

SEO Integrity Protection

Organizations that depend on search visibility and domain reputation can add controls specifically for SEO integrity.

First, automate monitoring through the Search Console API and search-result data sources such as SerpApi. Queries that combine site:[domain] with selected terms can identify unexpected pages or keywords associated with the domain. Matches can trigger alerts for investigation and corrective action.

Second, develop and deploy an SEO integrity proxy at the network edge. The proxy can identify search crawlers, inspect the response returned by the origin, and flag unexpected differences or gambling-related terms. At a minimum, use User-Agent as the verification source, but comprehensive checking may also require validating the crawler's source IP.

In some cases, the proxy can control the HTML returned to crawlers, including serving a static version. This centralizes control over indexed content and SEO integrity regardless of the HTML returned by the origin. The controlled HTML should remain consistent with the content available to regular visitors to avoid being flagged or penalized by search engines.

SEO integrity protection requires engineering effort, and not every organization will choose to pursue it. Based on our experience with institutional partners, however, these controls can be highly effective and useful.

What the Indonesian Government and Authorities Can Do

In November 2024, the Indonesian government established a cross-agency task force called Desk Pemberantasan Judi Online. It works to disrupt the promotion, financial flows, and core operations of illegal online gambling.

The government reported that the earlier task force reduced access to online gambling by 50 percent during its first month in 2024. PPATK later reported an approximately 30 percent decline in deposits in 2025, from Rp51.3 trillion to Rp36.01 trillion. The response also includes blocking bank accounts and digital wallets associated with illegal online gambling.

While efforts to eradicate online gambling require a further push and verification of earlier claims, hacked institutional websites also create risks beyond gambling promotion. Government action also needs to cover protection, detection, incident response, and recovery for the affected systems.

Government information systems in Indonesia are decentralized across ministries, provinces, regencies, cities, and public bodies. Each may use different technology and maintenance arrangements. Many systems were delivered as projects with limited ongoing application and infrastructure maintenance.

This fragmentation makes coordinated response difficult. Victims also extend beyond government to educational and private institutions.

The government has worked to remove illegal content and recover hacked assets. Further actions could include the following.

• Optimize the use of AI across all workflows related to online gambling eradication.
• Automate keyword searches and sweep official domains for hacking campaigns and illegal online gambling promotion.
• Correlate hacked domains, gambling brands, AMP pages, operator domains, bank accounts, phone numbers, and digital wallet identifiers for enforcement.
• Continuously disrupt brand visibility across search engines and social media.
• Pursue zero SEO Cloaking and illegal online gambling advertisements on .go.id domains through coordinated people, process, and technology controls.
• Publish transparent performance metrics and establish independent oversight of automated enumeration and enforcement actions.
• Improve the governance of government websites and information systems through engineering and security strategies that account for decentralized and legacy environments.

Cybercrime operations are scaling with AI. Government and defenders need comparable automation to expand detection and enforcement efficiently.

Outlook

The incidents in this case study represent a sample of a broader campaign. Different threat actors can adopt the same tactics, techniques, and procedures, particularly SEO Cloaking and the use of hacked websites as advertising infrastructure.

The Indonesian government must first improve the security of its own information systems and reassess the national strategy. The response also needs to cover the broader digital ecosystem and continue making it harder for illegal online gambling operators to attract users and receive deposits.

As long as online gambling promotions remain visible in search results through hacked government websites, sustained control will require further extensive work.