Check Point Gateways Exploited to Deploy VMware ESXi Wiper

Attackers are exploiting vulnerabilities in Check Point Security Gateways to deploy data-wiping malware on VMware ESXi hosts. The campaign involves chaining multiple flaws, including two PHP vulnerabilities known as PHP2Shell, to gain unauthorised access and escalate privileges for destructive purposes.

The campaign, which began on 30 October, initially focused on organisations in Israel before expanding to a global wave of attacks on 2 November. Threat actors managed the entire operation, from initial access and lateral movement to the final deployment of webshells and wipers.

Technical Execution and Malware Deployment

The attackers utilised PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, to gain entry via the Mobile Access portal. To escalate privileges to root, the actors exploited a newly disclosed zero-day vulnerability, CVE-2026-123039. Additionally, researchers found that attackers were chaining these bugs with the Fragnesia Linux kernel flaw to secure full system control.

Once access was established, the threat actors installed the TSGA backdoor and a networking component called TSProxy. This component allows attackers to receive commands concealed within regular network traffic. The final stage of the attack involved the deployment of destroy_v6, a data wiper that recursively deletes information in target directories. The malware can perform a zero-fill to make data recovery significantly more difficult.

The CISA Known Exploited Vulnerabilities (KEV) catalogue added the PHP2Shell issues on 26 October following evidence of active exploitation.

Political Motives and Attribution

The nature of the attacks suggests a destructive motive rather than financial gain. On several breached ESXi hosts, researchers discovered a file named DREAM_ANNEXATION.txt. This file contained political messages referencing ‘Dream Security Ltd.’ and explicitly stated that ransom negotiations would be rejected.

Check Point has tentatively linked the TSGA and TSProxy components to the PhiliKit malware framework. This framework was previously seen in attacks on Ivanti appliances and has been associated by ESET with the Chinese threat cluster UNC5221. However, the company noted that definitive attribution could not be confirmed based on current evidence.

Mitigation and Remediation

Check Point recommends that all customers install the November Jumbo Hotfix on all Management Servers and Security Gateways. This update addresses both the PHP2Shell vulnerabilities and the DynamicCLI privilege escalation flaw used in these attacks.

Administrators should also inspect their systems for indicators of compromise, including:

• Session files containing upload_progress_pwn;
• Unexpected CPconfigdaemon processes or binaries;
• Unexplained gaps in firewall logs;
• Unauthorised SSH activity originating from the gateway to internal VMware ESXi hosts.