Unpatched Check Point security gateways have been broken into through their Mobile Access login portals, and in at least one case the intruders went on to wipe files on a VMware ESXi server behind the firewall. The attackers first got in through the portal, then used a second flaw to gain root control of the appliance.
Check Point Research dates the activity to 30 October 2026, when the first wave hit Israeli organisations and was destructive for some of them. Three days later, on 2 November, a wider sweep went after firms in many countries and industries; the researchers found nothing destructive in that round.
The entry point is an exploit called PHP2Shell, aimed at the portal and tied to two flaws, CVE-2026-109618 and CVE-2026-109619. Check Point says the first attacks came about a week after a security fix had been released, so gateways that had not yet installed it were the ones exposed. Once inside, the attacker climbed from the portal’s service account to root through CVE-2026-123039, a local privilege-escalation bug in the DynamicCLI interface.
With root access the attackers planted PHP webshells in the folder the portal uses to build its login pages, named zz followed by random characters. They then launched a persistent backdoor called TSGA, which carries a proxy module named TSProxy, and ran a scanner called gogo to map the internal network. From the gateway they connected over SSH to an ESXi host using the vpxuser service account.
On that host they ran a wiper named destroy_v6. It walks a target folder, deletes files whatever their type and, unless run in fast mode, overwrites each one with zeros first. It also drops a politically themed note called DREAM_ANNEXATION.txt in every folder it processes, and the note rejects ransom talks.
Who is behind it is left open. TSGA and TSProxy are modified versions of PhiliKit, a toolkit earlier seen in attacks on Ivanti appliances and tied by ESET to a China-linked group, UNC5221. The infrastructure sat on LightNode servers and the scanning ran during Chinese working hours. Against that, the Israel focus and a note referring to the Israeli-Palestinian conflict do not fit that group’s known interests.
Check Point says the evidence cannot settle whether one actor ran everything, whether it only sold access to others, or whether the wiper was a false flag or a smokescreen. The note carries the Dream Security brand, a firm that had just published research on PHP2Shell attacks against Palo Alto devices, which raises the possibility of retaliation without proving a motive.
Admins running Mobile Access should check their gateways for the zz webshell files and a process named slot_CPconfigdaemon, both listed in the report, and apply the vendor’s fixes.
