[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fp2YeJk_pP7Hgml_y5oMYwAb7IZ-E_oNbUPvvOYzLfR0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"5118f196-bc08-4ddd-90cb-195570f96dac","unpatched-check-point-gateways-used-as-pivot-point-for-wiper-deployment","e1b91127-b053-4b1e-8af0-7e26b1f621da","Unpatched Check Point Gateways Used as Pivot Point for Wiper Deployment","Attackers exploited unpatched Check Point Security Gateways — devices that sit at the perimeter and are often trusted implicitly — to gain initial access and then pivot laterally to VMware ESXi hosts where a destructive wiper was deployed. The root cause is a failure to apply available patches to internet-facing network appliances, compounding the risk by allowing the gateway itself to serve as a launchpad deeper into the environment. This attack illustrates that security appliances are high-value targets precisely because they carry elevated trust and network access, yet are frequently overlooked in patching cycles. The deployment of a wiper underscores that delayed detection and inadequate network segmentation can turn an initial intrusion into an irreversible data-destruction event.","**Immediate actions:**\n- Apply all available vendor patches to Check Point gateways and other internet-facing security appliances immediately.\n- Audit perimeter devices for active webshells or unexpected outbound connections using EDR or gateway-level logging.\n- Isolate VMware ESXi hosts behind additional network controls so that gateway compromise cannot directly reach hypervisor management interfaces.\n\n**Long-term improvements:**\n- Establish a formal, prioritized patching SLA for internet-facing appliances (e.g., critical patches within 24–72 hours of release).\n- Maintain a continuously updated inventory of all network appliances, their firmware versions, and their exposure to the internet.\n- Implement micro-segmentation so that a compromised perimeter device cannot laterally reach hypervisor or backup infrastructure without additional authentication.\n\n**Detection measures:**\n- Deploy file-integrity monitoring on gateway devices to detect webshell drops or unauthorized file changes in web-accessible directories.\n- Alert on unexpected privileged process execution or new scheduled tasks on network appliances and hypervisors.\n- Ensure out-of-band, immutable backups of ESXi datastores exist and are tested regularly so wiper attacks do not result in permanent data loss.",[12,13,14,15,16],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-7: Boundary Protection","MITRE ATT&CK T1190: Exploit Public-Facing Application","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":18,"NIST SP 800-53 SI-2: Flaw Remediation":19,"NIST SP 800-53 SC-7: Boundary Protection":20,"MITRE ATT&CK T1190: Exploit Public-Facing Application":21,"CIS Control 7: Continuous Vulnerability Management (v8)":22},"This point requires security in acquisition, development, and maintenance including vulnerability handling; a formal vulnerability management process for the gateway appliance would have prevented the initial exploitation.","SI-2 requires timely identification and correction of information system flaws; had this control been enforced, the unpatched CVE exploited for privilege escalation would have been remediated before attackers leveraged it.","SC-7 requires managed interfaces and boundary protection between network segments; stronger boundary controls between the gateway and ESXi management plane would have prevented lateral movement and wiper deployment.","The attackers' initial access via exploitation of the unpatched Check Point gateway directly maps to this technique, highlighting the need for patch management and internet-facing asset hardening.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities in internet-facing assets; applying it would have surfaced the unpatched Check Point gateway before attackers exploited it.","published","2026-11-12T14:20:40.782513+00:00","2026-11-12T14:20:40.75+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fresearch.checkpoint.com\u002F2026\u002Fphp2shell-exploitation-on-check-point-gateway\u002F","php2shell-exploitation-on-check-point-gateway-502ecf","PHP2Shell Exploitation on Check Point Gateway",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[],[45,48,52],{"slug":34,"name":46,"problem":47},"Automated patch management","Known holes get closed in days, not months.",{"slug":49,"name":50,"problem":51},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":53,"name":54,"problem":55},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen."]