Ethical Hacking News
A recent attack by a group of hackers has exploited vulnerabilities in Check Point Security Gateways to gain initial access and deploy a stealthy backdoor called TSGA. The attack, which targeted Israeli organizations, as well as organizations across multiple countries and sectors, serves as a stark reminder of the ongoing threat landscape and the need for organizations to stay vigilant in the face of emerging vulnerabilities. The attack highlights the persistence of cyber espionage and the need for organizations to prioritize their cybersecurity posture.
Check Point Security Gateways were exploited by hackers to gain initial access and deploy a stealthy backdoor called TSGA. The attack targeted Israeli organizations, as well as organizations across multiple countries and sectors. The PHP2Shell vulnerability and a local privilege escalation flaw in Gaia OS were used to gain initial access and deploy the TSGA backdoor. The TSGA backdoor offers encrypted remote access, configuration theft, and binary firewall-log tampering. The attackers were identified as an unknown threat actor leveraging the PHP2Shell vulnerability and exploiting vulnerabilities in VMware ESXi hosts. The attack used wiper malware to destroy data and deployed the TSGA backdoor to gain persistent access to the system.
In a recent revelation, cybersecurity experts at Check Point have exposed a sophisticated campaign of cyber espionage, wherein a group of hackers exploited vulnerabilities in Check Point Security Gateways to gain initial access and deploy a stealthy backdoor called TSGA. The attack, which began on October 30, 2026, and was followed by a broader wave on November 2, 2026, targeted Israeli organizations, as well as organizations across multiple countries and sectors. This attack serves as a stark reminder of the ongoing threat landscape and the need for organizations to stay vigilant in the face of emerging vulnerabilities.
The PHP2Shell vulnerability, which was first identified by Check Point, provided the initial vector for the attack. According to Check Point, the attackers exploited this vulnerability to gain initial access to the system, followed by a previously unreported local privilege escalation flaw in Gaia OS, which enabled the deployment of the TSGA backdoor. The TSGA backdoor, which is a standalone passive backdoor that includes a second component called TSProxy, offers encrypted remote access, configuration theft, backup and snapshot persistence, process injection, and binary firewall-log tampering.
The attackers, who were identified as an unknown threat actor, leveraged the PHP2Shell vulnerability to gain initial access and then escalated privileges from the portal service account to root by weaponizing the CVE-2026-123039 vulnerability. They also deployed PHP web shells, which supported command execution and file upload capabilities, paving the way for the deployment of the TSGA backdoor.
The TSGA backdoor, which was first documented by ESET in June 2026, is attributed to a China-nexus cyber espionage group tracked as Armory Castle. The attackers also pivoted from the gateway to a VMware ESXi host over SSH, deploying the destroy_v6 wiper and leaving politically themed notes during the destructive stage.
The use of LightNode VPS infrastructure and the concentration of scanning activity between 12 and 9 a.m. UTC, coinciding with typical Chinese working hours, suggested the involvement of a possible China-aligned threat actor. However, Check Point noted that it did not have enough evidence to link the latest campaign to the threat actor or other known Chinese-nexus groups.
The attack serves as a stark reminder of the ongoing threat landscape and the need for organizations to stay vigilant in the face of emerging vulnerabilities. The use of wiper malware, which was deployed to destroy data, and the deployment of the TSGA backdoor, which offers persistent access to the system, underscore the severity of the threat.
In conclusion, the exploitation of PHP2Shell vulnerabilities in Check Point gateways by a group of hackers highlights the ongoing threat landscape and the need for organizations to stay vigilant in the face of emerging vulnerabilities. The use of stealthy backdoors and wiper malware underscores the severity of the threat, and the need for organizations to prioritize their cybersecurity posture.
Related Information:
https://www.ethicalhackingnews.com/articles/Exploitation-of-PHP2Shell-Vulnerabilities-in-Check-Point-Gateways-A-Malicious-Campaign-Reveals-the-Persistence-of-Cyber-Espionage-ehn.shtml
https://thehackernews.com/2026/11/hackers-exploit-php2shell-flaws-in.html
Published: Fri Nov 13 03:43:28 2026 by llama3.2 3B Q4_K_M
