PHP2Shell Exploitation on Check Point Gateway

* Activity targeted Israeli organizations via vulnerable Mobile Access portals on Check Point Security Gateways in late October 2026.
* Exploitation activity was consistent with PHP2Shell, linked to CVE-2026-109618 and CVE-2026-109619.
* Privilege escalation occurred from a portal service account to root by exploiting CVE-2026-123039 in the DynamicCLI IPC interface.
* PHP webshells were deployed using privileged command execution to establish persistence.
* Session artifacts containing uploadprogresspwn markers were created under /opt/CPcvpn-R81.20/tmp/.
* Apache/PHP workers experienced segmentation faults during exploitation attempts on October 30, 2026.
* A passive backdoor, TSGA malware (/tmp/CPconfigdaemon), was deployed to redirect output to /tmp/.bd.log.
* The TSGA implant relaunched as slot\CPconfigdaemon in the boot persistence directory and injected TSProxy (/lib/libcpfwcommon.so) into appliance processes to intercept networking functions.
* The attackers scanned for internal assets using gogo and moved laterally to a VMware ESXi host over SSH with vpxuser credentials.
* A destroy\v6 wiper was executed on the ESXi host, targeting /tmp/des wiper, accompanied by the file DREAM\ANNEXATION.txt.
* The PHP webshell required a hardcoded key for command execution and supported commands in plain-text, Base64, and XOR-obfuscated formats.
* The ELF wiper destroy\v6 accepts target directories and can exclude files; it also writes DREAM\ANNEXATION.txt upon processing.
* Tools identified include tpl webshell, slot\CPconfigdaemon, CPconfigdaemon, gogo, destroy\v6, DREAM\ANNEXATION.txt, philistine, libdssafe.so.
* Infrastructure IP addresses used included 130.94.19[.]204 and 130.94.19[.]168.

The narrative describes a multi-stage intrusion leveraging known vulnerabilities in Check Point Mobile Access portals to achieve deep system compromise. The initial access leverages specific CVEs and privilege escalation techniques to gain root access, demonstrating an understanding of internal service interfaces (DynamicCLI IPC). This immediately shifts the focus from simple exploitation to establishing persistent, stealthy control.
The transition to deploying PHP webshells demonstrates a clear methodology for maintaining web-based command and control, which is then evolved into a more sophisticated, low-level backdoor mechanism. The deployment of TSGA and TSProxy reveals an advanced technique: embedding functionality directly into system components (TSGA) while using shared libraries (TSProxy) to achieve stealthy network interception. This linkage to the PhiliKit family suggests the use of pre-existing, related toolsets, indicating a coordinated, established operational playbook rather than opportunistic attacks.
The final stage—lateral movement to an ESXi host and deployment of the destroy\v6 wiper—indicates an objective focused on destructive impact post-compromise, moving beyond simple data exfiltration or persistence toward disruption. The association with infrastructure previously linked to Chinese-nexus threat actors introduces a layer of complexity, suggesting potential false-flag operations or involvement by actors leveraging shared tooling lineage. This forces an inquiry into whether the observed activity reflects actor motivation (e.g., sabotage, espionage) or if it serves as a mechanism for operational testing utilizing known malware families and toolsets. What evidence exists to confirm the destructive action was the primary goal versus a smokescreen?