Check Point Research said on 12 November that attackers targeted unpatched Check Point Security Gateways in late October, about a week after a fix came out. On 30 October they hit Israeli organizations through the Mobile Access portal, the remote login site. In the case studied, one flaw gave entry and another gave root, the top level of control. The attackers then logged in to a VMware ESXi host over SSH and ran a wiper, which deletes files. A second wave on 2 November targeted some of the same organizations and others worldwide.
Check Point said neither wave showed a clear sector preference, and the second was not focused on Israel. It sees opportunistic attempts to get in. Who is behind it is open. The backdoor is a variant of PhiliKit, which ESET linked to UNC5221, a China-nexus group, but Check Point said the evidence does not allow a confident call.
A gateway is trusted, so whoever gets root inherits its reach. Here each step fed the next: portal access gave root, root allowed a backdoor that lets ordinary traffic pass, a scanner then found internal systems, and a service account opened the ESXi host. Attacks began about a week after the fix, so patch speed on these devices matters. Buyers can ask whether gateways can reach ESXi management and how tightly service accounts are limited.