Follow us on Google News
Hackers have exploited security vulnerabilities in unpatched Check Point Security Gateways to gain unauthorised access, install a previously undocumented backdoor and launch destructive attacks against VMware ESXi systems, according to findings released by cybersecurity firm Check Point.
The campaign began on October 30, 2026, with attacks targeting Israeli organisations, followed by a broader wave on November 2 involving organisations across multiple countries and industries.
Investigators found that attackers exploited two PHP2Shell vulnerabilities to gain initial access before using a separate privilege escalation flaw in Check Point’s Gaia operating system to obtain root-level permissions.
The attackers subsequently deployed malicious web shells, a persistent backdoor called TSGA and a networking component known as TSProxy. In some cases, they moved from compromised gateways to VMware ESXi hosts and executed malware designed to destroy files.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
How Did Hackers Exploit Check Point Security Gateways?
The initial attacks targeted vulnerable Mobile Access portals exposed on Check Point Security Gateways.
According to Check Point, suspicious activity originating from IP address 130.94.19[.]204 was observed targeting Israeli organisations in late October, approximately one week after security fixes became available.
The attackers exploited vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell.
After gaining access, they exploited another vulnerability, CVE-2026-123039, in the DynamicCLI component of Gaia OS.
The flaw, assigned a CVSS severity score of 7.8, arises from missing authorisation checks and allows an authenticated local user to execute commands with elevated privileges.
Successful exploitation enabled the attackers to escalate their access from the portal service account to root.
Check Point reported observing active exploitation of the vulnerability against approximately two dozen customers.
The affected products include Check Point Force Firewalls, Management and Log Servers, Multi-Domain Security Management systems, Multi-Domain Log Servers and Maestro Orchestrator.
Affected software versions include R82.20, R82.10, R82, R81.20, R81.10 and R81.
The attackers used their elevated permissions to install PHP web shells capable of executing commands and uploading files, establishing a foothold for further activity.
TSGA Backdoor Enabled Persistent Access and ESXi Attacks
Following the initial compromise, the attackers deployed a Linux backdoor known as TSGA, identified on affected systems under the name slot_CPconfigdaemon.
The malware was designed specifically for Check Point gateways and supported encrypted remote access, configuration theft, persistence through backups and snapshots, process injection and manipulation of binary firewall logs.
Its accompanying networking component, TSProxy, allowed attackers to conceal communications within legitimate appliance processes.
According to Check Point, TSProxy intercepted networking functions to recognise specially marked attacker connections while allowing ordinary traffic to continue.
The attackers also deployed a network scanning tool known as gogo to identify additional systems and services within compromised environments.
In some incidents, investigators observed the attackers moving from the security gateway to a VMware ESXi host using SSH and authenticating through the vpxuser service account.
Once inside the virtualisation environment, they deployed a Linux executable named destroy_v6.
The malware was designed to recursively access directories, overwrite files with zeros where possible and delete them regardless of file extension.
The attackers also placed a politically themed note named DREAM_ANNEXATION.txt in directories processed by the wiper.
Check Point linked these destructive actions to some organisations targeted during the initial October 30 campaign.
The subsequent November 2 wave included previously targeted Israeli organisations and additional victims worldwide, suggesting a broader effort to exploit vulnerable gateways.
Who Is Behind the Attacks and What Should Organisations Do?
Check Point identified technical similarities between TSGA, TSProxy and components of a malware toolkit known as PhiliKit.
The toolkit was previously documented in June 2026 and associated with a China-linked cyber espionage group tracked as Armory Castle, formerly UNC5221.
Investigators also observed the use of LightNode virtual private server infrastructure and scanning activity that broadly coincided with Chinese working hours.
However, Check Point said the available evidence was insufficient to confidently attribute the latest campaign to Armory Castle or another known China-linked group.
The company noted that the use of destructive malware, the initial focus on Israeli organisations and the political references in the wiper notes complicated the assessment.
Investigators considered several possibilities, including involvement by different operators, the use of an initial access broker or an attempt to mislead researchers about the attackers’ identity.
The company also raised the possibility that the destructive activity was intended to conceal other operations.
Security fixes have been made available for the affected Check Point products.
Organisations operating vulnerable gateways are advised to install the relevant updates and examine their systems for evidence of compromise.
Particular attention should be given to unauthorised web shells, unexpected changes to gateway configurations and suspicious connections between security appliances and internal servers.
The findings demonstrate how attackers can combine vulnerabilities in internet-facing security equipment with persistent malware to gain access to internal infrastructure.
In the incidents involving VMware ESXi systems, the compromise extended beyond the gateway itself, allowing attackers to carry out destructive actions against files stored on connected virtualisation hosts.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
