Unpatched Check Point Security Gateways were targeted from Oct.
30, 2026, with initial access via PHP2Shell vulnerabilities and privilege escalation via CVE-2026-123039.
The reported chain includes the persistent TSGA backdoor, its TSProxy networking component, a pivot to VMware ESXi hosts over SSH, and a Linux wiper that deletes files.
Attribution remains unconfirmed.
The attacks began with security vulnerabilities that allowed unknown individuals to enter systems through the company's main security gateways. The attackers then exploited an additional vulnerability that allowed them to gain elevated administrative privileges on devices. This gave them the ability to install programs that maintained persistent network access.
The first wave of attacks on October 30 targeted organizations in Israel, followed by a broader wave on November 2 across multiple countries and sectors. The affected products include firewalls, management and logging systems, as well as central management tools in specific versions.
After gaining access to the networks, the attackers were able to jump from the gateways to virtual machine hosting servers using service credentials, where they executed a malicious program that massively deleted files and left behind notes named DREAM_ANNEXATION.txt.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Attacks on N-central servers for cryptocurrency installation
↗
The tools used are linked to a toolkit known as PhiliKit, which was identified by security researchers in June 2026 and attributed to a group known as Armory Castle.
Researchers have identified evidence that points to a group based in China, such as the use of specific rented server infrastructure and activity during business hours in the country. However, the identity of the perpetrators remains uncertain and has not been fully confirmed, as the use of file destruction programs and political memos does not fit their usual profile.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)