Ethical Hacking News
Check Point gateways have been compromised worldwide, leading to root access, backdoors, network intrusion, and destructive wiper attacks. The attackers used PHP2Shell to gain initial access and escalate privileges, leaving a trail of destruction and confusion in their wake. The true nature of the attack remains unclear, but it highlights the importance of timely patching and robust security measures to minimize the impact of such attacks.
The PHP2Shell exploit was used to gain root access to unpatched Check Point gateways.The attack deployed PHP webshells, established persistence, and created a backdoor for encrypted remote access.A Linux wiper tool was used to delete files and overwrite them with zeros.A note was left in each folder processed, referencing the Israeli-Palestinian conflict and rejecting ransom talks.The attack was attributed to group UNC5221, linked to China, but the true nature of the attack remains unclear.Organizations are advised to review their patching schedules, implement robust security measures, and stay informed to stay ahead of evolving cyber threats.
The cybersecurity landscape has been rocked by a highly sophisticated and widespread attack against unpatched Check Point gateways, utilizing the PHP2Shell exploit to gain root access, deploy destructive wiper attacks, and establish persistence. The attack, which began on October 30, 2026, targeted various organizations across multiple countries, leaving a trail of destruction and confusion in its wake.
The attack began with the exploitation of a local privilege-escalation vulnerability in the DynamicCLI IPC interface, allowing the attackers to gain root privileges on the affected systems. From this newfound level of access, the attackers deployed PHP webshells, which were used to establish persistence and create a backdoor. The backdoor, known as TSGA, offered encrypted remote access, configuration theft, persistence through backups and snapshots, process injection, and tampering with binary firewall logs.
The attackers also utilized a tool called TSProxy, which was designed to run inside processes on the Check Point appliance and monitor network activity. This tool intercepted selected network connections used by the attackers while leaving normal network traffic unaffected. The attackers also used a Linux wiper, destroy_v6, to delete files in a target folder regardless of extension, overwriting them with zeros first unless run in fast mode, and could skip listed folders.
The attackers left a note named DREAM_ANNEXATION.txt in each folder they processed, which included a timestamp, was written in Hebrew, and referenced the Israeli-Palestinian conflict. The note rejected ransom talks, adding to the mystery surrounding the attack.
The attackers used LightNode VPS servers, a hosting provider also used by China-linked groups, to scan for vulnerabilities. The scanning activity took place between 00:00 and 09:00 UTC, corresponding to normal working hours in China. However, some aspects of the operation do not match UNC5221's known activity and objectives, leaving several explanations possible.
Check Point Research describes the activity as PHP2Shell for initial access, followed by a root-level privilege escalation tracked as CVE-2026-123039. The attack highlights the importance of timely patching and the need for organizations to stay vigilant in the face of sophisticated cyber threats.
The attack has been attributed to a group known as UNC5221, which has been linked to China. However, the true nature of the attack remains unclear, and several scenarios remain plausible, including the identified actor running the entire campaign, acting solely as an initial access broker, or taking part in a false-flag operation.
In light of this attack, it is essential for organizations to review their patching schedules and ensure that all systems are up to date. Additionally, it is crucial to implement robust security measures, including network segmentation, intrusion detection, and incident response plans, to minimize the impact of such attacks.
The PHP2Shell exploit is a reminder that cyber threats are constantly evolving and that no system is completely secure. As the threat landscape continues to shift, it is essential for organizations and individuals to stay informed and vigilant to stay ahead of the threats.
Related Information:
https://www.ethicalhackingnews.com/articles/Global-Widespread-Exploitation-of-Unpatched-Check-Point-Gateways-A-Sophisticated-PHP2Shell-Campaign-ehn.shtml
https://securityaffairs.com/202982/hacking/unpatched-check-point-gateways-are-being-wiped-exploiting-php2shell.html
Published: Fri Nov 13 07:37:07 2026 by llama3.2 3B Q4_K_M
