Date: 11/13/2026
Severity: High
Summary
Researchers uncovered PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) targeting unpatched Check Point Security Gateways, enabling initial access through vulnerable Mobile Access portals. Attackers subsequently exploited CVE-2026-123039 for root privilege escalation, deployed PHP webshells, and established persistence using the TSGA backdoor and embedded TSProxy component, enabling encrypted remote access, reverse shell execution, and network proxying. The campaign also involved internal network reconnaissance, SSH-based lateral movement to VMware ESXi infrastructure, and deployment of the destroy_v6 wiper for destructive activity. Researchers linked the implants to the PhiliKit malware framework, previously associated with China-nexus activity, but could not confidently attribute the overall campaign.
Indicators of Compromise (IOC) List
IP Address | 130.94.19.204 130.94.19.168 |
Hash | edb3e92eb7bda7413a09edcc4b1ba3cbed4bcdf42808a8abce63b6e4c3fda2b3
4171b521fa6441382aa2fa014a08e18ff9a6e0ab6096c9144072bf46b37a2ec8
d7549671c7189979f0624ec52dad9ea6a707d23146e3585ab8f8c4720eca0c63
3b51080a909023f7d484e2443740b572307ce0054eb9e32d98f0a06bfcd2db90
c7d9477309fac6c638a1128442056a242de086996add8cb49cd6496c36003237
0522937c0c0337be54fe25493539e5f5f8ceb9742c980aaff1cfc9515f3a96f7
ee16e1695711b9d60c62925fcfb2fe1a29c18ae26565bc05410a14e16d2a39d7
fb1a6235eb6bce8c9ec8cd8bb85f17c9c2bde8ecb45b7a243a30ceadf26654da
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | dstipaddress IN ("130.94.19.168","130.94.19.204") or srcipaddress IN ("130.94.19.168","130.94.19.204") |
Detection Query 2 : | sha256hash IN ("c7d9477309fac6c638a1128442056a242de086996add8cb49cd6496c36003237","d7549671c7189979f0624ec52dad9ea6a707d23146e3585ab8f8c4720eca0c63","4171b521fa6441382aa2fa014a08e18ff9a6e0ab6096c9144072bf46b37a2ec8","edb3e92eb7bda7413a09edcc4b1ba3cbed4bcdf42808a8abce63b6e4c3fda2b3","0522937c0c0337be54fe25493539e5f5f8ceb9742c980aaff1cfc9515f3a96f7","3b51080a909023f7d484e2443740b572307ce0054eb9e32d98f0a06bfcd2db90","fb1a6235eb6bce8c9ec8cd8bb85f17c9c2bde8ecb45b7a243a30ceadf26654da","ee16e1695711b9d60c62925fcfb2fe1a29c18ae26565bc05410a14e16d2a39d7")
|
Reference:
PHP2Shell Exploitation Targets Check Point Security Gateways