Vulnerable Check Point Security Gateway instances have been targeted in PHP2Shell attacks that deployed data-wiping malware on VMware ESXi hosts.

The attacks started on October 30, initially against Israeli organizations, and were conducted by an actor that ran the entire campaign, from initial access to lateral movement and launching PHP webshells.

In some instances, researchers found political messages during the destructive stage, raising questions about a possible false-flag operation.