Fast Facts
- Attackers exploited unpatched Check Point Mobile Access gateways via PHP2Shell, then used CVE-2026-123039 to gain root access.
- They installed webshells and persistent TSGA/TSProxy backdoors, enabling covert remote access and network pivoting.
- In some first-wave intrusions, attackers reached VMware ESXi hosts over SSH and deployed a wiper that deleted files; a later wave scanned targets across multiple countries.
Threat, Techniques, and Targets
- Targets: From October 30, 2026, attackers scanned and exploited unpatched Check Point Security Gateways with vulnerable Mobile Access portals. The first wave focused on Israeli organizations. Then, on November 2, attackers scanned organizations in several countries and sectors.
- Attack chain: Attackers used PHP2Shell, linked to CVE 2026 109618 and CVE 2026 109619, to gain initial access. Next, they exploited CVE 2026 123039 in the DynamicCLI interface to gain root access. They installed PHP webshells, the persistent TSGA backdoor, and the TSProxy networking component.
- Further activity: Attackers scanned internal networks, then used SSH to reach a VMware ESXi host. They deployed the destroy_v6 wiper and left DREAM_ANNEXATION.txt notes during destructive activity.
- Attribution: TSGA and TSProxy share technical links with PhiliKit, a toolset associated with China nexus actors. However, the available evidence does not confirm who ran the campaign or establish a clear motive.
Impact, Security Implications, and Remediation
- Impact: The first wave included destructive activity against some Israeli organizations. The second wave showed no evidence of destruction. The tools could also support persistent access, remote commands, configuration theft, and firewall log tampering.
- Security implications: A compromised gateway can give attackers a foothold for internal network discovery and lateral movement. Therefore, organizations should review gateway activity and connected systems for signs of compromise.
- Remediation: A security fix became available about one week before the reported activity. Apply the relevant Check Point security updates, and consult Check Point for affected versions and specific mitigation steps. Also investigate for the reported webshells, backdoors, scanner, wiper, and listed indicators of compromise.
Stay Ahead with the Latest Tech Trends
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
