Hackers Wipe Servers Using Check Point Gateway Flaws

Attackers are exploiting flaws in Check Point gateways to install backdoors and then permanently wipe connected virtual machine files.

An unknown hacking group is actively exploiting vulnerabilities in Check Point Security Gateways, turning the defensive tools into weapons. According to research from Check Point itself, these attacks allow intruders to gain full control of the devices, install a backdoor, and ultimately delete critical files on connected servers. The campaign, which initially targeted organizations in Israel, has since expanded, signaling a broader threat to enterprises using these widely deployed security appliances. The attackers are chaining together multiple vulnerabilities to achieve their objectives, turning a defensive tool into an offensive launchpad for destructive actions. This represents a serious escalation, as security infrastructure is typically a trusted part of a company's network defense.

The attack begins by exploiting a set of vulnerabilities collectively known as PHP2Shell. These flaws exist in the web-based management interface of the gateways and allow an attacker to execute arbitrary code remotely without needing to be authenticated. This gives them their initial foothold on the device. From there, the attackers leverage a separate, previously disclosed local privilege escalation vulnerability within Check Point's Gaia operating system. This second step allows them to elevate their permissions from a standard user to the highest level of administrative control. With full control, they deploy a custom backdoor named TSGA, which allows them to maintain access to the compromised gateway and use it as a pivot point for further attacks.

This incident is part of a worrying trend where threat actors specifically target the security and network infrastructure that organizations rely on for protection. Edge devices like firewalls, VPN concentrators, and security gateways are prime targets because they sit at the perimeter of the network, are often publicly accessible, and are implicitly trusted. A compromise of one of these devices provides a powerful position from which to launch internal attacks. We have seen similar campaigns targeting devices from Fortinet, Ivanti, and Cisco in recent years. The destructive nature of this particular attack—wiping VMware ESXi files—is especially alarming, moving beyond simple data theft or espionage into outright sabotage that can cripple business operations.

For any organization using Check Point Security Gateways, the immediate priority is to ensure all devices are patched and running the latest software versions. The vulnerabilities being exploited have fixes available, and failing to apply them leaves the door wide open. Beyond patching, security teams should actively hunt for indicators of compromise (IoCs) provided by Check Point and other security researchers. This includes looking for unusual network traffic originating from the gateways, unexpected processes running on the devices, and the presence of files associated with the TSGA backdoor. This incident serves as a stark reminder that no component of the IT stack is immune to attack, including the security tools themselves.

Looking ahead, the focus will be on attribution and the long-term goals of the threat actor. While their identity is currently unknown, the choice of targets and the destructive payload may offer clues. For developers and IT teams, this reinforces the principle of defense-in-depth. Relying on a single perimeter device is insufficient; internal network segmentation, strict access controls, and regular backups are critical layers of defense that can limit the blast radius of a compromised gateway. The ability to quickly restore from backups is the last line of defense against destructive attacks like the one seen here, turning a potentially catastrophic event into a manageable recovery operation.

This attack chain is significant because it turns a trusted security appliance into an entry point for destructive attacks. It combines remote code execution with privilege escalation to compromise the hypervisor layer, a worst-case scenario for infrastructure teams who rely on these gateways for protection.

A compromised security gateway can lead to catastrophic data loss and operational downtime, as attackers can wipe entire virtual environments. This represents a direct threat to business continuity, requiring immediate patch management and incident response validation to mitigate significant financial and reputational damage.