Check Point gateway flaws exploited in destructive wave against Israeli orgs

Key points

• An unattributed actor targeted Check Point gateway products and Gaia OS.
• Initial access involved PHP2Shell flaws; privilege escalation used a Gaia OS LPE.
• The intrusion included TSGA backdoor deployment and wiping of ESXi files.
• Israeli entities were affected, with a second wave reported October 30, 2026; no CVEs are assigned.

An unattributed adversary has been linked to a destructive intrusion set against Israeli entities, according to reporting dated October 30, 2026. This operation focuses on Check Point gateway devices and the Gaia OS platform, where attackers combine PHP2Shell flaws to gain initial entry and exploit a local privilege-escalation bug in Gaia OS to elevate their permissions.

Once positioned, the intruders dropped the TSGA backdoor and moved against VMware ESXi infrastructure, deleting files on those hosts. That combination—remote access plus wiper-like activity—raises the stakes beyond espionage: recovery can be slow, and virtualized workloads may be lost if backups are not isolated.

The activity appears to be a follow-up wave rather than an isolated incident, suggesting the actor is refining tooling and targeting. No CVE identifiers have been published for the flaws referenced, which complicates patch tracking and vulnerability management for defenders.

Organizations running Check Point Security Gateways should treat this as a high-severity operational risk. The absence of CVE records does not mean no fixes exist; it means defenders must rely on vendor guidance, configuration review, and detection rather than public vulnerability feeds.

Watch for unusual Gaia OS privilege changes, unexpected TSGA artifacts, and anomalous ESXi file deletions. Confirm backup integrity and isolation, and monitor for renewed scanning or exploitation attempts consistent with a second wave.

What to do now

1. Apply the latest Check Point hotfixes and Gaia OS updates; if no CVE is published, follow vendor security advisories and validate gateway versions.
2. Restrict management access to Security Gateways and Gaia OS to trusted admin networks; enforce MFA and review accounts for unexpected privilege changes.
3. Hunt for TSGA backdoor indicators on gateways and related hosts; isolate suspicious appliances and preserve logs.
4. Protect ESXi: restrict vSphere management interfaces, enable lockdown mode where feasible, and verify offline or immutable backups before any restore.
5. Audit PHP-facing services and PHP2Shell exposure on internet-facing systems; remove unnecessary components and add virtual patching or WAF rules.
6. Monitor for file-wiping behavior on ESXi datastores and alert on mass deletion or snapshot removal.
7. Segment gateway management from production workloads and rehearse recovery for virtualized systems.

Original source

The Hacker News