An Indonesian gambling syndicate has been hiding illegal online casinos and lottery pages inside official government websites across at least 16 countries, affecting around 20 government websites. Their motive is to leverage the credibility of these government websites to boost their casinos’ rankings in Google search results.
The syndicate is not operating crypto scams; it’s illegal online gambling, and no cryptocurrency is involved. The initial attack affected six countries: Nigeria, Egypt, Kenya, Uganda, Ghana, and South Africa, but has since expanded to 10 more countries: Mozambique, Malawi, Mauritania, Rwanda, Niger, Burkina Faso, Ethiopia, Libya, Madagascar, and Tanzania.
Google trusts a government (.gov) website. The syndicate’s mission isn’t to take down or steal data from these government websites. Rather, they simply slip their own casino pages into the government’s pages, so their gambling brands borrow the government’s reputation and rank higher on Google.
Independent security researcher and founder of Zend Cybersecurity Threat Labs, Chris Nwobi, who first discovered the syndicate’s activities, explains that a government domain is like a billboard on a highway, with the syndicate pasting their advert on it.
“On some sites, they hide it even better,” Nwobi notes. “Nigeria’s Federal High Court website looks completely normal to a regular visitor, but if you arrive from a Google search for gambling, it quietly serves you a casino instead.”
How it started
Nwobi says he first found out in May 2026, when three Nigerian federal sites: NILDS (National Institute for Legislative and Democratic Studies), NEMA (National Emergency Management Agency), and NAERLS (Agricultural Extension and Research Liaison Services), turned up serving Indonesian gambling content, with one of them carrying a “SLOT88” copyright line.
By June, the operation had expanded to include EFCC and sites in Egypt, Ghana, and Kenya. Everything points to Indonesia. The code was published on GitHub accounts working on Indonesian time, the payment pages used Indonesia’s national QR payment system, and the support numbers are Indonesian.
Nwobi says historical records show a gambling subdomain on the website of Nigeria’s Federal High Court as early as November 2024. And in some cases, this operation has likely been live for well over a year without anyone noticing.
As of today, the Federal High Court, NBC (National Broadcasting Commission), NEITI (Nigeria Extractive Industries Transparency Initiative), the Lagos State Public Procurement Agency, and Yobe State’s public financial management portal, among several others, have also been affected.
Victoria Fakiya – Senior Writer
Techpoint Digest
Stop struggling to find your tech career path
Discover in-demand tech skills and build a standout portfolio in this FREE 5-day email course
This is a coordinated operation by an organised group, not just one person.
What effect did it have?
The attack shows just how exposed and susceptible these government servers are. Many of the software has been outdated for years and unpatched, with databases and admin panels exposed to the internet. This wasn’t a sophisticated or dramatic attack; the door was left wide open, and no one was watching.
Nwobi explains that he doesn’t know how much the syndicate has made from the websites so far, as it’s difficult to estimate.
“The payments run through Indonesia’s QRIS national payment system into nominee accounts, and there is no way to turn that into a revenue figure from the outside.”
People trust their own government’s website, and that trust is what the Indonesian syndicate is latching on to, to advertise illegal foreign gambling and casinos to make money from the traffic it generates.
“The whole point was to send people to the casinos. The same group was also running fake pages pretending to be PayPal, Amazon and AT&T, so this is a financial fraud, not just spam.”
How can you verify yourself?
If you open Google and search “site:efcc.gov.ng togel slot gacor,” you will see EFCC’s anti-money laundering unit serving a page titled “LINETOGEL x TOGELUP Persembahan Situs Toto Slot,” a live Indonesian gambling site sitting on Nigeria’s financial crimes agency.
You can also search: “site: go.ke slot88 togel” for Kenyan government sites, and “site: gov.rw tajir777” for the Rwanda Broadcasting Agency.
You can verify for Egypt and Ghana by searching ‘site:gasreg.org.eg slot gacor’ and ‘site:folklore.gov.gh slot gacor,’ respectively. However, some sites have since been cleaned up, including Mozambique’s national portal and the Federal High Court.
The interesting case with Nigeria
When the findings reached Nigeria’s Minister of Communications, Bosun Tijani, he replied within three minutes, and the pages were taken down.
“On May 12th, I messaged Minister Tijani directly on LinkedIn with the disclosure at 8:57 a.m. He replied at 9:00 a.m., three minutes later, saying Galaxy Backbone and NITDA were on the case and that a mitigation strategy was being prepared. Three sites came down shortly after: NILDS, NEMA, and NAERLS.”
Nwobi says he was impressed by the minister’s prompt response. However, subsequent attempts to alert him to further development were unsuccessful.
He adds that he would have loved to see follow-through, since the takedown covered three pages while the rest of the .gov.ng estates were never audited (the Federal High Court was compromised again later, and the EFCC is compromised right now).
Also, it’ll be great to have a standing capacity to monitor for this, rather than one-off responses to individual reports, and a private channel that actually gets answered, rather than one that only responds when a disclosure is already public.
How does it relate to the Kenyan attack?
It was recently reported that the website of Kenya’s President was attacked, and the perpetrators defaced the homepage with messaging targeting President Williams Ruto. They also demanded a ransom of five Bitcoin. However, the Kenyan government says it has recovered the website.
In comparison, both attacks are different. The Indonesian syndicates are merely looking to route traffic from trusted .gov websites to their illegal online gambling platforms, and not looking to steal citizens’ data. Nwobi says their motive is ‘quiet, hidden, and all about the money.’
On the other hand, the Kenyan hack was more of a publicity stunt. The attackers needed visibility, so they defaced President Ruto’s website homepage, hoping the media would report the news, and it played out exactly as they imagined.
How do we address this menace?
To address this issue, Nwobi offers four points of advice in order of priority.
First, clean and patch: removing the gambling page without fixing the server that let attackers in just invites them back through the same door. Next is continuous monitoring: a search run automatically on a schedule would catch these attacks in days rather than months; right now, nobody is checking.
Third, cross-border coordination, since this is one operation running across 16 countries: national CERTs working together through AfricaCERT is the only response that scales to the actual problem. Lastly, a baseline security standard for government websites, since nearly all of these compromises trace back to the same door: outdated WordPress plugins on unmanaged hosting. Fixing the Nigerian sites took about an hour each. Fixing the continent is a matter of someone deciding it’s worth doing.
African governments need to implement round-the-clock monitoring of state websites, especially in this age of artificial intelligence, and ensure that securing digital gateways is a priority, not an afterthought, or they risk losing citizens’ and other vital information to hackers desperate to exploit loopholes.
