PHP2Shell and CVE-2026-123039 Exploited to Compromise Check Point Gateways, Deploy Wiper
Threat actors are exploiting Check Point Security Gateways using PHP2Shell for initial access, followed by CVE-2026-123039 for privilege escalation, leading to wiper deployment on VMware ESXi.
Beginning on October 30, 2026, attackers initiated scanning and exploitation activities against organizations with unpatched Check Point Security Gateways. The initial access vector was the Mobile Access portal, leveraging the PHP2Shell vulnerability, followed by privilege escalation through CVE-2026-123039. This campaign saw two distinct waves: the first on October 30 targeted Israeli organizations, some of which experienced destructive activity. A broader second wave on November 2 expanded globally, affecting organizations across multiple countries and sectors, though this wave did not exhibit destructive behavior.
The infection chain begins with attackers gaining access to the Mobile Access portal. From there, they escalate privileges from a portal service account to root by exploiting CVE-2026-123039, a local privilege-escalation vulnerability within the DynamicCLI interface. This privileged command execution allows the attackers to deploy PHP webshells within the portal's template directory, establishing a more robust foothold. These webshells are capable of executing commands, and the attackers subsequently replaced them with more advanced versions requiring a hardcoded key, supporting operating system commands, PHP code execution, and file uploads.
Following the webshell deployment, the attackers established persistence by launching the TSGA malware, a backdoor, in the background. This malware, when executed as root, relocates itself and relaunches under a different name for persistence. Crucially, TSGA also deploys TSProxy, an embedded shared library that intercepts networking functions. This allows attackers to handle specially marked connections while permitting normal traffic to flow unimpeded, effectively creating a covert channel.
With a persistent backdoor in place, the attackers utilized the gogo scanner on the gateway to identify internal assets and services. They then moved laterally to a VMware ESXi host via SSH, authenticating using the vpxuser service account. On the compromised ESXi host, the attackers staged and executed the destroy_v6 wiper, a destructive payload designed to erase data. During the destructive phase, the attackers left behind notes titled DREAM_ANNEXATION.txt, containing politically themed messages.
TSGA and TSProxy are identified as modified variants of PhiliKit, a malware framework previously observed in attacks exploiting Ivanti vulnerabilities. Both tools share significant code, configuration, and cryptographic similarities with the PhiliKit framework. While ESET has previously associated PhiliKit with China-nexus threat actor UNC5221, the attribution for this specific operation remains uncertain. Several scenarios are plausible, including the possibility that a single actor conducted the entire campaign, acted as an initial access broker, or engaged in a false-flag operation. The destructive activity and the notes left behind could also be intended as a diversionary tactic.
The note left during the destructive activity references the Dream Security brand. Notably, Dream Security had recently published research on PHP2Shell exploitation of Palo Alto Networks devices by China-nexus actors. This timing raises questions about potential retaliation, but the available evidence does not provide a clear motive or confirm this connection.
The campaign's targeting initially focused on Israeli organizations but expanded significantly in the second wave, indicating opportunistic initial access attempts rather than a specific sector focus. The exploitation of widely used Check Point Security Gateways, coupled with the deployment of advanced backdoors and a wiper, highlights the critical need for timely patching and robust security measures against sophisticated threat actors.