In late October 2026, attackers exploited a series of vulnerabilities in Check Point firewalls to obtain root access, deploy backdoors, and unleash destructive malware on VMware ESXi hosts. The campaign began on October 30 within Israeli organizations and by November 2 had spread globally across industries, though the later phase showed no signs of file destruction.
How the Exploit Chain Unfolded
The attack chain started with the exploitation of Check Point Mobile Access portals via vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619, both involving PHP2Shell. Using these entry points, attackers escalated privileges by exploiting CVE-2026-123039 in the Gaia operating system’s DynamicCLI service. This service runs as root and allows local users to issue commands via /tmp/dynamic_socket, but fails to properly validate the command source—opening the door for full system control once local code execution is achieved.
Malware, Backdoors, and ESXi Infection
After gaining root privileges, the intruders deployed PHP webshells in template directories on the affected portals. These webshells supported system commands, PHP code execution, and file transfers via a hard-coded key. The attackers also planted a backdoor dubbed TSGA, running under the process slot_CPconfigdaemon, which included a component labeled TSProxy. Stored in /lib/libcpfwcommon.so, this component was injected into appliance processes to facilitate covert connections via regular services.
Next in the chain was the use of a scanner tool called Gogo to identify internal systems. Attackers then gained SSH access to a VMware ESXi host using the vpxuser account. The deployed malware—named destroy_v6—walked through target directories to delete files, usually overwriting them with zeros; in a quicker “fast mode,” it skipped the overwrite step entirely. Victims also found ransom rejection notes under the name DREAM_ANNEXATION.txt.
Tool Overlaps & Affected Systems
Analysis revealed that the TSGA/TSProxy tools share code, settings, and cryptographic materials with PhiliKit—an existing toolkit previously associated with UNC5221, a group linked to China. Although similarities exist, there’s no conclusive evidence tying this incident to that actor; access brokering or misleading attribution remain possibilities.
The vulnerabilities affect Check Point releases from R81 up through R82.20, covering management, logging, and Maestro appliances; Spark Firewalls and Smart-1 Cloud are not impacted. Fixes are available in Jumbo Hotfix versions starting with R82.20 Take 14, R82.10 Take 52, R82 Take 132, and R81.20 Take 174.
Detection & Mitigation Guidance
Administrators are urged to check the /var/log/dynamicCli.log for activity outside normal Clish wrapper commands, and cross-verify those entries against portal access and login records. Post-patch, the /tmp/dynamic_socket permissions should be set to 0660 with ownership under root:config instead of the more permissive 0777. Disabling the dynamic_server service stops DynamicCLI commands but also shuts off legitimate functionality—useful only as a temporary containment measure.
This compromise chain is distinct from previously reported VPN exploits—though some vulnerabilities overlap in impact, this specific attack leveraged unique entry vectors. The first destructive wave, mainly in Israel, points to a targeted strike; but the second wave’s breadth sans data destruction suggests reconnaissance or opportunistic expansion.
Why it matters: organizations relying on vulnerable Check Point firewalls or ESXi hosts are at risk of total system takeover or data wipe. Attackers achieved full control through privilege escalation rather than mere remote exploits—a far more dangerous scenario.
What to watch: upcoming reports that may tie this campaign to known threat actors; any signs of data leaks despite no current evidence; ensuring your firewall is updated; tightening local access controls to services like DynamicCLI.
