7th September – Threat Intelligence Report
Check Point weekly bulletin: exploited SonicWall SMA 1000 zero-days (CVE-2026-83548/49), JFrog Artifactory auth bypass, and a 2.8M-patient Baylor Genetics breach.
70
Threat actor
Gambling Goblin
- Mentions · 7d0
- Mentions · 30d0
- All mentions4
- First seenSep 2, 2026
- Last mentionedSep 7, 2026
Timeline
4 articles · newest firstGambling Goblin Turns Brazilian Government Sites Into SEO Weapons
Check Point links Chinese-speaking cluster Gambling Goblin to SEO-fraud compromises of Brazilian government sites via malicious Apache modules since mid-2025.
64
Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages
Check Point links Gambling Goblin, a Chinese-speaking cluster, to malicious Apache modules hijacking Brazilian government servers to promote betting sites.
48
Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon
Check Point identifies Chinese-speaking group Gambling Goblin hijacking Brazilian government domains via malicious Apache modules for SEO-manipulated gambling phishing.
55
Related CVEs
by mentions- CVE-2026-835488%10.0Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface
- CVE-2026-8232914%9.8Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access
- CVE-2026-8354910%7.8Authenticated OS Command Injection RCE in SonicWall SMA1000 Appliance Console
Appears with
- Check Pointvendor · 3
- DownPromalware · 3
- Apacheproduct · 3
- AlphaAgentmalware · 3
- oRATmalware · 3
- Earth Berberokathreat actor · 3
- Check Point Researchorganization · 2
- Trend Microvendor · 2
- SonicWallvendor · 1
- CrowdStrike Falconproduct · 1
- C-Trackproduct · 1
- Earth Berberokaorganization · 1
- FBIorganization · 1
- JFrogvendor · 1
- SMA 1000product · 1
- PollCatmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.