An unknown threat actor targeted unpatched Check Point Security Gateways to gain initial access through PHP2Shell vulnerabilities and then a previously unreported local privilege escalation flaw in Gaia OS to deploy a backdoor called TSGA. Check Point said the activity began on October 30, 2026, first hit Israeli organizations, and then expanded on November 2, 2026, to organizations across multiple countries and sectors.
Gateway intrusion and destructive follow-up
Check Point said the first wave used PHP2Shell to reach the gateway and then DynamicCLI privilege escalation, tracked as CVE-2026-123039. After that, the attackers deployed PHP web shells, the persistent TSGA backdoor, and its embedded TSProxy networking component. In a destructive stage, they pivoted from the gateway to a VMware ESXi host over SSH, deployed the destroy_v6 wiper, and left DREAM_ANNEXATION.txt notes.
CVE-2026-123039 and affected versions
CVE-2026-123039 carries a CVSS score of 7.8. It is a missing authorization flaw that could enable privilege escalation to root in the DynamicCLI process, and any authenticated local user could run arbitrary commands by writing a single request to the socket. Check Point said the issue is a local privilege escalation that requires the attacker to already have local code execution on the appliance, and it observed active exploitation against a couple of dozen customers.
The flaw affects R82.20, R82.10, R82, R81.20, R81.10, and R81 of Check Point Force Firewalls, Check Point Management and Log Servers, Multi-Domain Security Management and Multi-Domain Log Server, and Maestro Orchestrator.
How the campaign reached and persisted
Check Point said that in late October 2026, about one week after a security fix became available, activity from 130.94.19[.]204 targeted Israeli organizations through vulnerable Mobile Access portals on Check Point Security Gateways. It said evidence suggested some successful compromises, with exploitation activity consistent with PHP2Shell and associated with CVE-2026-109618 and CVE-2026-109619.
After initial access, the unknown hacking group escalated from the portal service account to root by weaponizing CVE-2026-123039 and then deployed PHP web shells to establish persistent access. Those web shells support command execution and file upload capabilities. Check Point described the November 2, 2026, wave as hitting some of the same Israeli organizations, along with other organizations worldwide, without showing a specific geographic or sector preference.
TSGA and TSProxy on compromised gateways
The web shell access opened the path to TSGA, which Check Point described as a standalone passive backdoor that also includes TSProxy. Deployed as slot_CPconfigdaemon, TSGA is a Linux gateway implant with Check Point-specific functionality. It offers encrypted remote access, configuration theft, backup and snapshot persistence, process injection, and binary firewall-log tampering.
Check Point said TSProxy injects its code into selected appliance processes, where it intercepts networking functions for specially marked attacker connections while ordinary traffic continues. That combination creates a persistent standalone backdoor with concealed access through existing appliance services.
Post-exploitation actions and wipe activity
Other actions observed after compromise included deploying the gogo scanner on the gateway to find internal assets and services across the network. The attackers also moved laterally to a VMware ESXi host over SSH by authenticating with the vpxuser service account.
They staged a Linux ELF wiper called destroy_v6 and executed it. The malware recursively traverses the target directory, deletes all files regardless of extension, and attempts to overwrite files with zeros before deleting them. It also dropped a note named DREAM_ANNEXATION.txt in each processed directory.
Attribution remains unconfirmed
Check Point assessed TSGA and TSProxy as Check Point-specific components of a toolkit called PhiliKit, first documented by ESET in June 2026 and attributed to a China-nexus cyber espionage group tracked as Armory Castle, formerly UNC5221. It also pointed to possible China-aligned involvement based on LightNode VPS infrastructure and scanning activity concentrated between 12 and 9 a.m. UTC, which matched typical Chinese working hours.
The company said it does not have enough evidence to connect the latest campaign to that threat actor or other known Chinese-nexus groups. It cited the use of wiper malware and the focus on Israel, along with explicit references to the Israeli-Palestine conflict in the wiper note. Check Point said the evidence does not allow a high-confidence assessment of the operation’s true nature, and it listed several possibilities: the identified actor ran the campaign, acted only as an initial access broker, took part in a false-flag operation, or used destructive activity as a smoke screen.
Licensed under CC BY-ND 4.0 International