Hackers Exploit Check Point Firewall Flaws to Gain Root Access and Deploy Wiper Malware on VMware ESXi

Hackers have chained Check Point firewall vulnerabilities to gain root access, plant backdoors, and deploy destructive malware on a VMware ESXi host.

The campaign began on October 30, 2026, targeting Israeli organizations before expanding worldwide. Check Point confirmed that attackers exploited the privilege escalation flaw against a couple of dozen customers.

The supplied investigation describes two waves. The first included destructive activity against some Israeli targets. A second wave on November 2 reached organizations across several countries and sectors, with no evidence of data destruction. Neither wave showed a clear industry focus.

Attackers gained initial access through vulnerable Check Point Mobile Access portals, using PHP2Shell exploitation linked to CVE-2026-109618 and CVE-2026-109619. After reaching the portal service account, attackers exploited CVE-2026-123039 to run commands as root.

The flaw, rated 7.8, affects the Gaia operating system’s DynamicCLI service. Its dynamic_server process runs as root and accepts commands through /tmp/dynamic_socket. Vulnerable systems give every local user permission to write to this socket. At the same time, the service fails to verify who submitted a command.

An attacker with local code execution can therefore send a request that runs with full system rights. This is not a standalone remote access flaw. The Check Point advisory confirms that prior access is required. Related coverage of Check Point VPN exploitation describes separate vulnerabilities, not this campaign’s entry chain.

After gaining root access, the attackers planted PHP webshells inside the portal’s template directory. The expanded webshell supported system commands, PHP execution, and file uploads protected by a hardcoded key.

They then installed TSGA, a persistent Linux backdoor that ran as slot_CPconfigdaemon. Its embedded TSProxy component was written to /lib/libcpfwcommon.so and loaded into appliance processes. This allowed hidden attacker connections to pass through existing services while normal traffic continued.

Hackers Exploit Check Point Firewall Flaws

The attackers used the Gogo scanner to find internal systems, then connected to an ESXi host over SSH using the vpxuser service account. They deployed the destroy_v6 wiper, which walks through target directories, normally overwrites files with zeros, and deletes them. Its fast mode skips overwriting.

The malware also dropped DREAM_ANNEXATION.txt notes rejecting ransom negotiations. Separate reporting on GhostFrame attacks against VMware ESXi highlights another threat to virtualization hosts.

Checkpoint Research found that TSGA and TSProxy share code, settings, and cryptographic material with PhiliKit, previously linked to China-associated UNC5221, but found no evidence connecting the toolkit to this incident or confirming who controlled the operation, leaving tool reuse, access brokering, and false flags as possible explanations.

Check Point lists affected releases from R81 through R82.20, including management, logging, and Maestro products. Spark Firewalls and Smart-1 Cloud are unaffected. Fixed Jumbo Hotfix releases begin at R82.20 Take 14, R82.10 Take 52, R82 Take 132, and R81.20 Take 174.

Administrators should examine /var/log/dynamicCli.log for commands outside the normal Clish wrapper and correlate findings with portal and login records. Patched sockets should show permissions 0660, owned by root config, rather than 0777.

Temporarily stopping dynamic_server blocks this route but turns off Dynamic CLI commands. Rejected connection logs show blocked attempts, not proof that earlier compromise was prevented.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs

The post Hackers Exploit Check Point Firewall Flaws to Gain Root Access and Deploy Wiper Malware on VMware ESXi appeared first on Cyber Security News.