Attackers broke into unpatched Check Point Security Gateways at Israeli organizations in late October, climbed to root, planted a backdoor built specifically for Check Point appliances, and then moved to a VMware ESXi host where they ran a wiper and left a politically themed note. Check Point Research, in a report by VP of Research Lotem Finkelstein, says the first wave began on October 30, 2026, roughly a week after a security fix became available.
It is unusual to see a vendor document an intrusion through its own product in this much detail. What makes this one harder to read is the toolkit: it overlaps with malware previously tied to a China-nexus espionage group, yet the operation ended in destruction aimed at Israel.
From the VPN login portal to root
Initial access came through the Mobile Access portal, with exploitation consistent with PHP2Shell, the PHP flaw pair tracked as CVE-2026-109618 and CVE-2026-109619 that CISA has already listed as exploited. Check Point found PHP session files carrying an upload_progress_pwn marker under /opt/CPcvpn-R81.20/tmp/, and hundreds of segmentation faults in the portal's Apache/PHP workers in the same window, a sign of repeated exploitation attempts.
From the portal's service account, the attackers escalated to root through CVE-2026-123039, a local privilege-escalation flaw in the gateway's DynamicCLI interface. They then dropped PHP webshells named zz*.tpl into the directory the portal uses to build its login pages, later swapping in a version that requires the key zz2026 and supports commands, PHP execution and file uploads.
A backdoor made for Check Point, then a wiper
Next came TSGA, a Linux implant launched as /tmp/CPconfigdaemon that relaunches itself as slot_CPconfigdaemon. Check Point says it provides encrypted remote access, configuration theft, persistence through backups and snapshots, process injection and tampering with binary firewall logs. It carries TSProxy, a shared library written to /lib/libcpfwcommon.so and injected into appliance processes to quietly handle specially marked attacker connections.
The attackers ran the gogo scanner to map internal networks, moved over SSH to an ESXi host using the vpxuser service account, and executed a Linux wiper called destroy_v6. By default it overwrites files with zeros before deleting them, and it drops a note, DREAM_ANNEXATION.txt, that explicitly rejects ransom negotiation. A broader second wave on November 2 hit organizations in multiple countries and sectors, with no sign of destructive activity.
The China-nexus kit does not explain the motive
TSGA and TSProxy are modified variants of PhiliKit, a framework previously seen in attacks on Ivanti appliances that ESET has associated with UNC5221. They share code, cryptographic material, a TLS certificate and operator credentials. The infrastructure sat on LightNode VPS hosting, and scanning clustered between 00:00 and 09:00 UTC, which lines up with Chinese working hours.
But Check Point says the destructive focus on Israel and a Hebrew wiper note referring to the Israeli-Palestinian conflict do not fit known China-nexus motives, and it does not assess the operation's nature with high confidence. The scenarios it leaves open: the same actor ran everything, it acted only as an initial access broker, the operation was a false flag, or the wiper was a smoke screen. The note uses the brand of Dream Security, which had recently published research on PHP2Shell exploitation of Palo Alto Networks devices, but Check Point says the evidence does not establish a motive.
Patch Mobile Access gateways, then hunt for these files
- Apply Check Point's fixes for the Mobile Access PHP2Shell exposure and CVE-2026-123039. The report does not publish CVSS scores for these flaws.
- Look for zz*.tpl files in the portal template directory, /tmp/.up.tpl, an unexpected challenge_render.tpl, /tmp/CPconfigdaemon, slot_CPconfigdaemon, /lib/libcpfwcommon.so, the Unix socket /tmp/.p_sock and listeners on TCP port 11072.
- Review SSH logins to ESXi hosts with the vpxuser account that originate from gateway addresses.
- Block 130[.]94[.]19[.]204 and 130[.]94[.]19[.]168.
- SHA-256: TSGA 4171b521fa6441382aa2fa014a08e18ff9a6e0ab6096c9144072bf46b37a2ec8; destroy_v6 c7d9477309fac6c638a1128442056a242de086996add8cb49cd6496c36003237; webshell edb3e92eb7bda7413a09edcc4b1ba3cbed4bcdf42808a8abce63b6e4c3fda2b3.
Edge devices keep proving to be the cheapest door into a network. This case adds a second lesson: the tooling that walks through those doors gets passed around, so the malware family alone is a poor guide to who is inside.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.