Attackers exploited PHP2Shell vulnerabilities to breach Check Point Security Gateways and deploy destructive malware on VMware ESXi hosts. The campaign began on October 30 against Israeli organizations, with a second wave hitting companies in multiple countries on November 2. The threat actor used the flaws to gain root access, install backdoors, and execute a data wiper that recursively deletes files. Researchers found political messages on compromised systems, suggesting a possible false-flag operation. Check Point advises customers to install the November Jumbo Hotfix and check for signs of compromise.
Read the full story at bleepingcomputer.com.
