An unknown threat actor has been observed targeting unpatched Check Point Security Gateways to obtain initial access via the PHP2Shell vulnerabilities and then a previously reported local privilege escalation flaw in Gaia OS to deploy a backdoor called TSGA.
The activity, detailed by Check Point, began on October 30, 2026, and targeted Israeli organizations, with a broader follow-up wave on November 2, 2026, that targeted organizations across multiple countries and sectors. Some of the organizations singled out in the first wave have also been at the receiving end of destructive actions that include the deployment of wiper malware.
"PHP2Shell provided initial access, followed by privilege escalation through the DynamicCLI interface, tracked as CVE-2026-123039," Check Point said. "The attackers then deployed PHP web shells, the persistent TSGA backdoor, and its embedded TSProxy networking component."
"The attackers pivoted from the gateway to a VMware ESXi host over SSH, deployed the destroy_v6 wiper, and left politically themed DREAM_ANNEXATION.txt notes during the destructive stage."
CVE-2026-123039 (CVSS score: 7.8) is a missing authorization flaw that could enable privilege escalation to root in the DynamicCLI process, enabling any authenticated local user to run arbitrary commands by writing a single request to the socket.
"The issue is a local privilege escalation and requires the attacker to already have local code execution on the appliance," Check Point said, adding it "observed an active exploit of this vulnerability against a couple of dozen customers."
The issue impacts versions R82.20, R82.10, R82, R81.20, R81.10, and R81 of the following products –
- Check Point Force Firewalls
- Check Point Management and Log Servers
- Multi-Domain Security Management and Multi-Domain Log Server
- Maestro Orchestrator
"In late October 2026, approximately one week after a security fix became available, activity originating from 130.94.19[.]204 targeted Israeli organizations through vulnerable Mobile Access portals on Check Point Security Gateways," Check Point said.
"Evidence suggested some cases of a successful compromise, with exploitation activity consistent with PHP2Shell, associated with CVE-2026-109618 and CVE-2026-109619."
After obtaining initial access, the unknown hacking group is said to have escalated privileges from the portal service account to root by weaponizing CVE-2026-123039 and deploying PHP web shells with an aim to establish persistent access. The web shells support command execution and file upload capabilities.
The November 2, 2026, wave is said to have targeted some Israeli organizations that had already been targeted in the first wave, alongside other organizations worldwide, without demonstrating any specific geographic or sector preference, indicating an opportunistic initial-access effort.
The access afforded by the web shell paves the way for TSGA, a standalone passive backdoor that also includes a second component called TSProxy. TSGA, deployed as slot_CPconfigdaemon, has been described as a Linux gateway implant with Check Point-specific functionality, offering encrypted remote access, configuration theft, backup and snapshot persistence, process injection, and binary firewall-log tampering.
"[TSProxy's] injection code loads this library into selected appliance processes, where it intercepts networking functions to handle specially marked attacker connections while allowing ordinary traffic to continue," Check Point said. "This combines a persistent standalone backdoor with concealed access through existing appliance services."
Some of the other post-exploitation actions observed are listed below –
- Deploying the gogo scanner on the gateway to discover internal assets and services across the network.
- Moving laterally to a VMware ESXi host over SSH by authenticating with the vpxuser service account.
- Staging a Linux ELF wiper called destroy_v6 and executing it. The malware recursively traverses the target directory and deletes all files regardless of their extension. It also attempts to overwrite files with zeros before deleting them.
- Dropping a note named "DREAM_ANNEXATION.txt" in each processed directory.
Both TSGA and TSProxy are assessed to be Check Point-specific components of a toolkit dubbed PhiliKit that was first documented by ESET in June 2026, attributing it to a China-nexus cyber espionage group tracked as Armory Castle (formerly UNC5221).
Other factors that point to the involvement of a possible China-aligned threat actor include the use of LightNode VPS infrastructure and the fact that scanning activity was concentrated between 12 and 9 a.m. UTC, coinciding with typical Chinese working hours.
However, the cybersecurity company said it does not have enough evidence to link the latest campaign to the threat actor or other known Chinese-nexus groups, citing the following reasons –
- Use of wiper malware
- Focus on Israel and explicit references to the Israeli-Palestine conflict in the wiper note
"Taken together, the evidence does not allow us to assess with high confidence the true nature of this operation," Check Point said. "Several scenarios remain plausible: the identified actor ran the entire campaign, acted solely as an initial access broker, or took part in a false-flag operation. It is also possible that the destructive activity served as a smoke screen."
Deja una respuesta