Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack

Executive Summary

Beginning October 30, 2026, an unattributed threat actor exploited unpatched Check Point Security Gateways using PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) for initial access, then escalated privileges to root via a local flaw in Gaia OS (CVE-2026-123039) affecting the DynamicCLI interface. Attackers deployed PHP web shells, the persistent TSGA backdoor with its TSProxy networking component, and pivoted over SSH to VMware ESXi hosts where the destroy_v6 wiper malware recursively deleted and zeroed files. Israeli organizations were primary targets in the first wave, with a broader opportunistic second wave on November 2, 2026, leaving politically themed ransom notes referencing the Israeli-Palestine conflict.

This incident illustrates the accelerating convergence of cyber espionage and destructive operations against network edge appliances. The use of a China-nexus toolkit (PhiliKit, attributed to Armory Castle) alongside wiper malware and false-flag indicators signals a maturing trend where APT actors blur attribution lines, forcing defenders to prioritize edge device patching, lateral movement controls, and east-west segmentation as primary defensive postures.

Why This Matters Now

Network security appliances remain high-value initial access targets, and attackers are now pairing espionage implants with destructive wipers in the same campaign. With CVE-2026-123039 actively exploited within one week of patch availability and ESXi environments being wiped across multiple countries, organizations running unpatched Check Point gateways or flat east-west network architectures face immediate and compounding risk of data loss and operational disruption.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Attackers exploited two PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) targeting unpatched Mobile Access portals on Check Point Security Gateways, then escalated privileges to root by abusing CVE-2026-123039 in the DynamicCLI process to deploy persistent web shells and the TSGA backdoor.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant to this incident because the attacker relied on unrestricted inbound access to an exposed gateway portal, uncontrolled internal pivoting across service account boundaries, and unchecked outbound channels to sustain operations. By enforcing segmentation, identity-scoped routing, and controlled egress at the network fabric level, CNSF would likely have reduced the attacker's reachability and constrained the blast radius at multiple stages before destructive impact was achieved.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Allowlist-based ingress policies enforced at the fabric level could have meaningfully reduced the reachability of the vulnerable Mobile Access portal to unauthorized external source IPs, limiting the attacker's ability to deliver exploit traffic against the exposed interface in the first place.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust identity-based segmentation policies would likely have constrained the portal service account's ability to reach or interact with administrative interfaces like the DynamicCLI socket, reducing the scope of what an already-compromised low-privilege process could access within the gateway's own service boundary.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west segmentation controls enforcing workload-to-workload policies between the gateway and ESXi management interfaces would likely have constrained the attacker's ability to reach hypervisor SSH surfaces, reducing the pivot path's viability even after the gateway itself had been compromised.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Centralized traffic observability across the cloud fabric would likely have surfaced anomalous outbound connection patterns from the gateway to unrecognized LightNode VPS destinations, giving defenders a meaningful opportunity to detect and respond to the covert C2 channel before it could be sustained over an extended operational window.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress controls applying FQDN filtering and outbound policy enforcement on gateway traffic would likely have constrained unauthorized data flows to unrecognized external VPS infrastructure, reducing the attacker's ability to quietly move sensitive configurations and credentials out of the environment during the pre-destructive operational phase.

Impact (Mitigations)

Had prior CNSF controls constrained lateral movement and limited the attacker's access to ESXi management interfaces, the residual risk at this stage would likely have been significantly reduced in scope, with wiper execution potentially confined to fewer hypervisor hosts rather than spreading across the broader virtualized environment.

Impact at a Glance

Affected Business Functions

  • Network Perimeter Security and Firewall Operations
  • Virtualization Infrastructure and ESXi Workload Continuity
  • Security Operations Center (SOC) and Threat Monitoring
  • Data Integrity and Configuration Management
Operational Disruption

Estimated downtime: 14 days

Financial Impact

Estimated loss: N/A

Data Exposure

Sensitive network configuration data, firewall rule sets, VPN credentials, and backup snapshots were at risk of theft via the TSGA backdoor and TSProxy implant. The destroy_v6 wiper malware caused confirmed destructive deletion and zero-overwrite of files on VMware ESXi hosts across compromised Israeli organizations, resulting in irrecoverable data loss for affected virtual machines. Post-exploitation use of the gogo scanner exposed internal asset topology and service inventories. Politically themed wiper notes (DREAM_ANNEXATION.txt) were dropped across processed directories, indicating deliberate sabotage. Financial loss estimates are unconfirmed publicly but are assessed as substantially high given confirmed data destruction at dozens of customer sites across critical infrastructure and enterprise sectors.

Recommended Actions

  • • Deploy Inline IPS (Suricata) with active signatures covering CVE-2026-109618, CVE-2026-109619, and CVE-2026-123039 exploit patterns to detect and block PHP2Shell exploitation attempts against exposed network security appliance management interfaces at the perimeter before initial compromise occurs.
  • • Enforce Zero Trust Segmentation with identity-based least-privilege policies that restrict portal service accounts from accessing privileged local interfaces such as DynamicCLI sockets, and require explicit authorization for any inter-workload SSH sessions between gateway appliances and hypervisor hosts to contain privilege escalation and lateral movement.
  • • Implement East-West Traffic Security controls to monitor and enforce policy on workload-to-workload and service-to-service traffic flows between security gateways and VMware ESXi management planes, ensuring that compromised gateway processes cannot authenticate to or communicate with internal hypervisor infrastructure without verified identity and policy approval.
  • • Activate Egress Security and Policy Enforcement with FQDN filtering and outbound destination allowlisting on all network security appliances to block unauthorized outbound connections from gateway processes to unrecognized external VPS infrastructure used for TSGA C2 communications, and to prevent exfiltration of gateway configurations and credentials.
  • • Leverage Multicloud Visibility and Control with centralized traffic observability and anomaly detection to establish behavioral baselines for gateway management traffic, generate real-time alerts on anomalous outbound connections, mass internal scanning activity consistent with gogo scanner use, and bulk file deletion operations on ESXi hosts indicative of wiper malware execution.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image