Unknown Attackers Use Wiper Against Check Point Gateways, Compromise VMware ESXi

Key points

• Security Gateway appliances from Check Point were targeted and compromised.
• A destructive wiper was deployed during the intrusions.
• VMware ESXi hosts were also compromised.
• No CVE identifier has been assigned to track the activity.
• PHP2Shell and unidentified attackers are linked to the campaign.

An intrusion campaign has hit Security Gateway appliances from Check Point, leaving gateway systems compromised and destructive wiper code deployed in the environment. The activity has been linked to PHP2Shell as well as unidentified attackers. No CVE identifier has been assigned to the event, so defenders cannot rely on a single tracking number to scope exposure.

The affected footprint is described in terms of vulnerable gateway instances, which means organizations operating exposed or unmanaged Security Gateway deployments should assume risk until they can verify integrity. VMware ESXi infrastructure is also implicated: hosts have been compromised in connection with the campaign, expanding the incident beyond the perimeter appliance layer.

Gateway devices are high-value because they often sit at network edges and enforce remote-access policy. When one is compromised, intruders can weaken perimeter trust, reach internal systems, and operate with less friction. The wiper element makes the event more dangerous than a simple unauthorized login, because destructive code can erase data and complicate recovery even after access is contained.

The lack of a CVE does not make the threat less urgent; it shifts the burden to environmental evidence. Analysts should correlate gateway logs, ESXi host activity, and configuration changes rather than waiting for a signature. The PHP2Shell overlap suggests possible ties to broader exploitation activity, but attribution remains incomplete and should be treated cautiously.

Administrators should watch for gateway tampering, unexpected ESXi host behavior, and signs of file destruction. Preserve logs and images before rebuilding, isolate suspect systems, and confirm that backups are clean and restorable. The key question is whether the wiper has already executed in any production segment.

What to do now

1. Inventory every Security Gateway appliance from Check Point, flagging internet-facing, unmanaged, or end-of-support deployments for immediate review.
2. Isolate suspected compromised gateways and VMware ESXi hosts from production traffic; preserve logs, memory, and disk images before rebuilding.
3. Hunt for unauthorized gateway configuration changes, new administrative accounts, and ESXi host anomalies that could indicate intrusion or wiper staging.
4. Rotate credentials and revoke sessions, API keys, and certificates tied to gateway and ESXi management interfaces.
5. Verify offline backups of gateway configurations and ESXi workloads, and test restoration before reconnecting systems.
6. Restrict management access to trusted networks, apply current vendor hardening guidance, and monitor for PHP2Shell-related activity.

Original source

BleepingComputer