Unknown Threat Actor Exploits Check Point Gateways to Plant TSGA Backdoor and Wipe ESXi Hosts
Unknown threat actors exploited unpatched Check Point Security Gateways using PHP2Shell and CVE-2026-123039 to install TSGA and destroy_v6, wiping VMware ESXi hosts. The case shows how a perimeter firewall can become a foothold for stealthy persistence, log tampering and destructive lateral movement. Affected Check Point customers face direct exposure and must prioritize patching and forensic review.
Check Point reported that activity began Oct. 30, 2026, when traffic from 130.94.19[.]204 targeted Israeli organizations through vulnerable Mobile Access portals on unpatched Security Gateways. The intrusion chain used PHP2Shell flaws tied to CVE-2026-109618 and CVE-2026-109619, then escalated privileges through DynamicCLI using CVE-2026-123039. The actor deployed PHP web shells, then the TSGA backdoor and TSProxy component, before pivoting over SSH to VMware ESXi hosts and running the destroy_v6 wiper with DREAM_ANNEXATION.txt notes.
The evidence trail is technical: Check Point said the missing authorization flaw, CVE-2026-123039, scored 7.8 on CVSS and lets any authenticated local user run arbitrary commands as root by writing one request to the DynamicCLI socket. The company said it observed active exploitation against a couple of dozen customers. Impacted software includes Force Firewalls, Management and Log Servers, Multi-Domain Security Management and Log Server, and Maestro Orchestrator across R81 through R82.20.
The campaign shows a firewall compromise becoming a network-wide incident. PHP2Shell gave the actor a foothold on the appliance; TSGA provided encrypted remote access, configuration theft, backup persistence, process injection and firewall-log tampering. TSProxy hides attacker traffic inside normal appliance processes. The second wave on Nov. 2, 2026, included previously targeted Israeli organizations and other organizations worldwide, with no clear geographic or sector preference, suggesting opportunistic access collection. Attribution remains unknown in the source, though wiper notes carry political language.
The stakes are enterprise and virtualization infrastructure. Check Point gateways sit at network edges, and a root compromise lets attackers steal configurations, alter logs, and move laterally. The source says attackers used vpxuser to reach ESXi hosts and executed destroy_v6, a Linux ELF wiper that traverses target directories. That turns perimeter security appliances into launch points for destructive operations. Organizations using affected Check Point products face exposure until patched, and defenders must treat firewall logs as potentially compromised evidence.
Organizations running affected Check Point gateways are exposed because attackers can gain root access, hide inside firewall services, tamper with logs, and destroy VMware ESXi hosts. The incident raises the risk that a compromised perimeter device can become a launch point for destructive operations across enterprise networks.
Sources (1)
- [1]Original source(https://thehackernews.com/2026/11/hackers-exploit-php2shell-flaws-in.html)