Overview
- Attackers used two critical PHP engine vulnerabilities called PHP2Shell to gain unauthenticated remote code execution, and Check Point confirmed the chain led to root via a DynamicCLI local privilege escalation tracked as CVE-2026-123039.
- The campaign unfolded in two waves, with a destructive round that began on October 30 targeting Israeli organizations and a broader opportunistic wave that began on November 2 affecting companies in multiple countries without a clear sector focus.
- After gaining root, operators deployed PHP web shells and installed a persistent gateway implant named TSGA plus an injected networking component called TSProxy, which intercepts selected connections and conceals attacker access.
- From compromised gateways the attackers ran internal scanning, authenticated to VMware ESXi hosts with vpxuser, staged a destroy_v6 ELF wiper that recursively overwrote and deleted files, and dropped politically themed 'DREAM_ANNEXATION.txt' notes in some cases.
- Researchers link TSGA/TSProxy to components of the PhiliKit toolkit documented by ESET and note infrastructure and timing that point to China‑nexus actors, but Check Point says evidence is insufficient for high‑confidence attribution and urges immediate patching, interface isolation, and forensic hunting for pre‑patch compromises.