An unidentified threat actor has been leveraging vulnerabilities in Check Point Security Gateways, specifically targeting unpatched systems through PHP2Shell flaws. This security breach has allowed the deployment of a backdoor known as TSGA, utilizing an unreported privilege escalation flaw in Gaia OS.
Initial Breach and Escalation
The attack campaign, disclosed by Check Point, commenced on October 30, 2026, initially impacting Israeli entities. A subsequent wave on November 2, 2026, expanded to various international sectors. The initial phase involved PHP2Shell vulnerabilities to gain access, followed by exploiting a local privilege escalation tracked as CVE-2026-123039, allowing attackers to execute arbitrary commands through a socket request.
Check Point reported active exploitation of this vulnerability against several clients, affecting product versions such as R82.20, R82.10, among others. Despite a security patch release, malicious activities continued, emphasizing the need for urgent updates.
Deployment of TSGA Backdoor
After obtaining entry, attackers elevated privileges from a portal account to root, deploying PHP web shells for persistent access. These actions facilitated the installation of TSGA, a passive backdoor with an auxiliary component named TSProxy. TSGA allows encrypted remote access and configuration theft, while TSProxy intercepts network functions to manage attacker connections stealthily.
Subsequent actions included deploying a gogo scanner for internal asset discovery and lateral movement to VMware ESXi hosts. The attackers utilized the destroy_v6 wiper, leaving politically charged notes labeled “DREAM_ANNEXATION.txt” in affected directories.
Analysis of Threat Actor and Implications
Check Point’s analysis suggests the toolkit used, dubbed PhiliKit, may originate from a China-linked espionage group known as Armory Castle. However, insufficient evidence prevents a definitive attribution, with factors such as working hours and VPS infrastructure hinting at a possible China nexus.
The campaign’s focus on Israeli entities and its use of wiper malware raise questions about motives, with Check Point considering several potential scenarios, including a false-flag operation.
As the cybersecurity landscape evolves, organizations must remain vigilant against such sophisticated threats. Ensuring timely updates and robust security measures can mitigate risks associated with vulnerabilities like PHP2Shell.
