Back The420.In

Organizations in Israel and Other Countries Hit by Check Point Firewall Exploitation

The420.In • November 14, 2026

Cybercriminals have exploited multiple security vulnerabilities in Check Point Security Gateways to infiltrate organizational networks across several countries, including Israel. The attackers gained initial access through two flaws collectively known as PHP2Shell before escalating privileges to root level using a separate vulnerability in Gaia OS. Once inside, they deployed a new backdoor named TSGA alongside a networking component called TSProxy, and later accessed VMware ESXi servers at several victim organizations to erase files using wiper malware.

Cybersecurity investigations indicate the first phase of the campaign began on October 30, 2026, primarily targeting organizations in Israel. A second wave followed on November 2, striking entities across multiple countries and sectors, including several institutions that had already been targeted during the initial wave.

Initial Breach and Privilege Escalation

The attackers targeted vulnerable Mobile Access portals on Check Point Security Gateways affected by the PHP2Shell flaws, tracked as CVE-2026-109618 and CVE-2026-109619. Attacks against Israeli networks in the final week of October originated from the IP address 130.94.19[.]204. Although security patches had been available for roughly a week at that point, organizations that had not updated their systems remained exposed. After gaining entry via PHP2Shell, the intruders deployed web shells to execute commands, upload files, and establish persistence.

In the stage, the attackers exploited a local privilege escalation flaw in Gaia OS, tracked as CVE-2026-123039 with a CVSS score of 7.8. The vulnerability stems from insufficient authorization checks in the DynamicCLI interface, allowing an authenticated user with local code execution to send a request over a socket, run arbitrary commands, and obtain root access. Check Point confirmed active exploitation affecting a few dozen customers across versions R82.20, R82.10, R82, R81.20, R81.10, and R81, impacting Check Point Force Firewalls, Management and Log Servers, Multi-Domain Security Management, Multi-Domain Log Servers, and Maestro Orchestrator.

Persistent Backdoor and ESXi Wiper Attacks

After securing root privileges, the hackers installed the TSGA backdoor, deployed on Linux-based Check Point gateways under the name slot_CPconfigdaemon. TSGA provides encrypted remote access, enabling attackers to steal device configurations, maintain persistence across backups and snapshots, inject code into processes, and tamper with binary firewall logs. They also deployed TSProxy, a networking component that injects a library into existing processes to intercept networking functions and forward crafted attacker connections alongside normal traffic, making detection difficult.

Using an internal scanner named gogo to map network devices and services, the intruders moved laterally to VMware ESXi hosts via SSH using the vpxuser service account. There, they deployed a Linux-based ELF wiper malware called destroy_v6, which deletes files regardless of extension and in some cases attempts to overwrite data with zeros before removal. In affected directories, the attackers left a text file named DREAM_ANNEXATION.txt containing political messages.

Suspected Links and Ongoing Investigation

Investigators linked TSGA and TSProxy to the PhiliKit toolkit, documented by ESET in June 2026 and previously associated with the China-linked cyber espionage group Armory Castle, also tracked as UNC5221. Additional clues pointing toward a possible Chinese connection include the use of LightNode VPS infrastructure and scanning activity concentrated between 9 a.m. and 12 p.m. UTC, aligning with working hours in China.

However, researchers have not formally attributed the campaign to a China-backed actor, noting that the use of destructive wiper malware and political messaging tied to the Israel-Palestine conflict could indicate a false flag operation or involvement by multiple threat groups. Investigators continue to examine whether a single group executed the entire operation or if separate actors provided initial access, warning that delayed patching on perimeter security appliances exposes entire internal networks and virtualization infrastructure to severe compromise.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Attackers Exploit Check Point Vulnerabilities to Deploy Wiper Malware Beginning on October 30, 2026, attackers exploited unpatched vulnerabilities in Check Point Security Gateways, specifically the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) and a local privilege escalation vulnerability (CVE-2026-123039). The initial wave targeted Israeli organizations, leading to root access and the deployment of a persistent backdoor named TSGA, which facilitated destructive actions against VMware ESXi hosts. A second wave on November 2 expanded the attack to multiple countries without destructive outcomes. Check Point confirmed that the attackers exploited these vulnerabilities to gain access, escalate privileges, and deploy wiper malware. The campaign is characterized as opportunistic rather than sector-specific, with evidence of active exploitation against a couple of dozen customers. The vulnerabilities were publicly disclosed shortly before the attacks, with patches available but not applied by the affected organizations. 14 sources 73

Extracted Entities

​Organizations in Israel and Other Countries Hit by Check Point Firewall Exploitation

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (2)

CVEs (3)

CWE Weaknesses (2)

Malware (3)

MITRE ATT&CK (5)

Platforms (4)

Tools (2)

Organizations in Israel and Other Countries Hit by Check Point Firewall Exploitation