Cybersecurity researchers have uncovered a hacking campaign targeting unpatched Check Point Security Gateways, exploiting PHP2Shell vulnerabilities to gain initial access before deploying a previously undocumented backdoor known as TSGA.
The attackers reportedly exploited an additional privilege escalation vulnerability in Gaia OS to obtain root access, establish persistent control over compromised devices and, in some cases, launch destructive attacks against VMware ESXi infrastructure.
According to an investigation published by Check Point, the campaign began on October 30, 2026, with attacks targeting Israeli organisations. A second wave followed on November 2, expanding the operation to organisations across different countries and industries.
Some organisations affected during the initial phase were subsequently targeted with wiper malware designed to permanently delete files.
Check Point explained that the attackers first gained access through PHP2Shell vulnerabilities before exploiting a local privilege escalation flaw in the DynamicCLI interface, tracked as CVE-2026-123039.
The attackers then installed PHP web shells, the persistent TSGA backdoor and an embedded networking component called TSProxy.
Researchers also observed the hackers moving from compromised security gateways to VMware ESXi hosts through SSH connections, where they deployed a destructive Linux malware known as destroy_v6.
The attackers reportedly left politically themed messages titled DREAM_ANNEXATION.txt in directories processed by the wiper malware.
CVE-2026-123039 carries a CVSS severity score of 7.8 and is classified as a missing authorisation vulnerability. The flaw could allow an authenticated local user to execute arbitrary commands with root privileges by sending a single request through a socket used by the DynamicCLI process.
Check Point clarified that exploiting the vulnerability requires an attacker to have already obtained local code execution on the affected appliance. The company said it had detected active exploitation against approximately two dozen customers.
The vulnerability affects several product versions, including R82.20, R82.10, R82, R81.20, R81.10 and R81, across the following Check Point systems:
-
Check Point Force Firewalls
-
Check Point Management and Log Servers
-
Multi-Domain Security Management and Multi-Domain Log Server
-
Maestro Orchestrator
Check Point said the first wave of suspicious activity originated from the IP address 130.94.19[.]204 in late October, approximately one week after a security update became available.
The attackers focused on vulnerable Mobile Access portals exposed through Check Point Security Gateways belonging to Israeli organisations.
Investigators identified evidence of possible successful compromises, with exploitation patterns matching the PHP2Shell vulnerabilities associated with CVE-2026-109618 and CVE-2026-109619.
Following initial access, the attackers reportedly escalated their privileges from the portal service account to root by exploiting CVE-2026-123039.
They subsequently installed PHP web shells capable of executing commands and uploading files, providing a means of maintaining access to compromised systems.
The November 2 campaign targeted some organisations previously affected in Israel while expanding to additional victims across multiple countries. Researchers said the broader operation showed no clear preference for a particular geographical location or industry, suggesting that the attackers were also pursuing opportunistic access to vulnerable systems.
The PHP web shells served as an entry point for deploying TSGA, a standalone passive backdoor designed specifically for Linux-based Check Point gateways.
Installed under the filename slot_CPconfigdaemon, TSGA provides several capabilities, including encrypted remote access, configuration theft, persistence through backups and snapshots, process injection and manipulation of firewall logs.
Its accompanying component, TSProxy, provides another layer of concealed access by intercepting network functions within selected appliance processes.
Check Point explained that TSProxy injects a library into targeted processes, allowing it to identify and handle specially marked connections from the attackers while leaving ordinary network traffic unaffected.
This arrangement enables the hackers to maintain a persistent backdoor while disguising their communications within legitimate gateway services.
Beyond installing the backdoor, investigators documented several additional activities carried out after the attackers gained control of the devices.
These included deploying a network scanning utility called gogo to identify internal systems and services, as well as moving laterally to VMware ESXi infrastructure through SSH.
The attackers reportedly authenticated to an ESXi host using the vpxuser service account before transferring and executing the destroy_v6 wiper.
The malware is designed to recursively scan targeted directories and delete files regardless of their extensions. It also attempts to overwrite files with zeros before removing them, making recovery more difficult.
During the destructive operation, the attackers deposited a file named DREAM_ANNEXATION.txt in each directory processed by the malware.
Researchers believe TSGA and TSProxy are specialised components of a broader toolkit known as PhiliKit, which was first documented by cybersecurity firm ESET in June 2026.
ESET previously associated the toolkit with a China-linked cyber espionage group tracked as Armory Castle, formerly known as UNC5221.
Additional indicators potentially pointing towards a China-aligned actor include the use of LightNode virtual private server infrastructure and scanning activities concentrated between 12 a.m. and 9 a.m. UTC, a period that overlaps with typical working hours in China.
However, Check Point cautioned that the available evidence is insufficient to confidently attribute the latest campaign to Armory Castle or another known China-linked hacking group.
The researchers highlighted several elements that complicate attribution, particularly the deployment of destructive wiper malware and the campaign’s focus on Israeli organisations.
The politically themed messages left behind by the attackers also contained explicit references to the Israeli-Palestinian conflict.
According to Check Point, several explanations remain possible. The identified threat actor may have conducted the entire operation, acted as an initial access broker supplying compromised systems to another group, or participated in a false-flag operation designed to mislead investigators about the attackers’ identity.
The destructive attacks may also have been intended to serve as a diversion from the broader intrusion campaign.
The company said it could not determine the true nature of the operation with a high degree of confidence.
Meanwhile, the United States Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-123039 to its Known Exploited Vulnerabilities catalogue on November 13, 2026.
The inclusion confirms that the vulnerability is being actively exploited in real-world attacks and places it under the agency’s mandatory remediation requirements for federal civilian agencies.
Under the directive, affected federal agencies are required to apply the relevant security update by November 16, 2026.
The campaign highlights the risks posed by internet-facing security appliances that remain unpatched, particularly when attackers can combine remote access vulnerabilities with local privilege escalation flaws to establish persistent control and move into critical infrastructure.