Check Point Gateways and Mobile Access Hit by Worldwide Wiper Campaign

Key points

• Unknown actor targets Check Point Security Gateways and Mobile Access portal.
• Activity spans worldwide and was observed on 30 October.
• Exploitation enables root-level control, backdoors, and network intrusion.
• Destructive wiping reported; no CVE identifiers assigned.

On 30 October, an unknown adversary launched a worldwide campaign that probes and exploits Check Point Security Gateway appliances and the Mobile Access portal. The operation has moved from reconnaissance into active intrusion: successful exploitation gives the attacker root-level control, allows backdoors to be planted, opens paths into internal networks, and culminates in destructive wiping. No CVE identifiers have been assigned to the activity.

Organizations that expose these Check Point components are in scope. Because gateways and remote-access portals sit on the perimeter, a compromise can expose far more than the appliance itself. Root privileges and backdoors give an intruder persistence and lateral-movement options, while wiper behavior turns an access incident into an availability and recovery crisis. The global reach means both public and private sectors should treat this as a live threat, not a theoretical one.

Check Point products named in the activity include Security Gateways, Mobile Access portal, and PHP2Shell. With no CVE to anchor detection, defenders cannot rely on a single signature or patch identifier. The absence of a CVE does not mean low risk; it means hunting must focus on behavior, exposure, and post-exploitation artifacts. The 30 October timing provides a starting point for log review.

K-12 and government networks often depend on remote-access portals and perimeter gateways for staff, students, and administrators. A wiper event or root-level compromise can interrupt instruction, erase records, and force lengthy recovery. Watch for scanning against portal endpoints, unusual authentication patterns, new privileged accounts, unexpected outbound connections, and signs of file destruction. Confirm exposure, apply vendor mitigations, and prepare to isolate affected systems quickly.

What to do now

1. Inventory every internet-facing Check Point Security Gateway and Mobile Access portal, then restrict management and portal access to trusted networks and enforce MFA.
2. Review logs from 30 October onward for scanning, exploitation attempts, anomalous portal requests, new privileged accounts, and unexpected processes.
3. Isolate and rebuild any confirmed compromised appliance; rotate credentials, certificates, and keys; remove persistence before restoring service.
4. Apply the latest Check Point fixes and mitigations, disable unused portal features, and follow vendor guidance until CVE details are available.
5. Segment gateway management and remote-access traffic from internal networks, enforce least privilege, and monitor outbound connections for command-and-control.
6. Back up configurations offline, test restoration, and prepare a wiper-specific incident response playbook.
7. Hunt for web shells, scheduled tasks, services, SSH keys, and PHP2Shell-related artifacts that could indicate backdoors.

Original source

Security Affairs