On October 30, Israeli organizations started losing ESXi hosts to an unpatched Check Point Security Gateway. An unknown actor used PHP2Shell flaws for a foothold, a previously unreported local privilege escalation on Gaia OS, a backdoor called TSGA, and a wipe of hypervisor files. If your cybersecurity program still treats the edge appliance as a perimeter gadget and the hypervisor as plumbing, this week showed you the cost of that split.

The Wipe Started on October 30

Check Point’s incident write-up, as reported by The Hacker News, puts the first wave on Israeli networks, then a broader follow-up. The people writing TSGA are already shopping the same unpatched image against whoever still has it on the internet.

PHP2Shell got them a shell on the gateway. The Gaia OS bug got them root-equivalent control of the device. TSGA kept that control after reboot and after the tired 2 a.m. hotfix email. Then they reached ESXi and wrecked hypervisor files. Recovery means backups nobody else can reach, on hardware that still has a clean image.

You’re used to a firewall as the box that drops packets and maybe logs a brute-force spray against the admin portal. That job description is too small. A modern gateway is a full operating system with a web stack, a management plane, stored credentials, and routing into every VLAN you were too busy to segment. Once the actor owns that OS, threat-protection policies on the data plane are theater. They sit on the device that publishes those policies.

Citrix spent the same week shipping patches for 10 critical NetScaler vulnerabilities. The notes cite unexpected behavior and denial of service. Internet-facing ADC and gateway bugs are how this class of operator buys the first hour. After that hour, they stop caring about your guest OS tools.

Your Cybersecurity Stack Never Watched the Hypervisor

Kaspersky’s ransomware write-up this week is the other half of the same job. Crews have learned to abuse ESXi and vCenter features you enabled for convenience. Lock the host, encrypt or shred the datastores, and every virtual machine dies in one motion.

Most threat detection still lives in the guest. Agents, EDR, whatever you brand as cyber security on the Windows server, those sensors go dark the moment the hypervisor that runs them is locked or wiped. The logs you planned to hand an incident response team sit on disks the attacker just destroyed. You are then reconstructing a crime from vCenter events you cannot trust and a SAN that looks empty.

Look at the access paths in the Kaspersky analysis. Leftover service accounts. vCenter roles that mean admin in practice. SSH left on ESXi “for the vendor.” Backup software that reused the production password. Management interfaces reachable from too many VLANs. Defense in depth on the slide deck often means three products inside the VM and nothing authoritative on the host. That’s how a gateway implant becomes a cluster-wide event.

The tell is quieter than a desktop ransom note. VMs fail to start, datastores disappear, and the help desk files a storage ticket. By the time someone with vSphere rights looks, the attacker has had the run of the control plane.

Lock the Edge, Then Prove the Cluster Is Clean

Do the ugly work in this order. First, inventory every internet-facing gateway, ADC, and VPN concentrator. Confirm the PHP2Shell-class Check Point fixes and this week’s NetScaler advisories are installed on the running image, not sitting in a download folder. If a Gaia box was unpatched on or after October 30, treat it as compromised. Rebuild it. Hunt for TSGA. Rotate every credential, API key, and certificate that device could have seen, including LDAP binds, RADIUS secrets, and stored admin hashes.

Then assume they walked from the edge to vCenter. Pull ESXi and vCenter logs for new local users, SSH keys, unexpected VIBs, modified host firewall rules, scheduled tasks, and datastore unmounts or deletes. Lock down SSH. Kill shared root. Put MFA on vCenter and give people the least role that still lets them work. Move hypervisor management onto a dedicated network that does not share a path with user VLANs or the gateway’s inside interface. Keep snapshot-independent backups you can restore without a healthy vCenter, and test that restore on hardware the attacker never touched.

Security hardening here is boring on purpose. Disable unused management services on ESXi. Set a lockout that survives a brute-force run against the host DCUI and SSH. Watch admin portals the same way you watch OWA: failed logins, success from new ASNs, password sprays at 3 a.m. Law enforcement’s Operation Endgame seized 235 servers, 257 domains, and 6.4 million stolen credentials from Gootloader, CastleRAT, and StealC campaigns. Some of those passwords still open a vCenter or a gateway. Stolen infostealer loot is a second path to the same wipe, and it does not need PHP2Shell.

Ongoing, put edge appliances on the same patch SLA as your public web apps. Review the ESXi and vCenter baseline quarterly, including who can mount datastores and who can push host profiles. Tabletop a hypervisor wipe with out-of-band communications, because email and chat often live on the VMs you just lost.

The real problem here is an architecture habit. You poured budget into guest OS controls and treated the hypervisor as furniture. Attackers noticed. They’ll keep entering through the gateway you delayed patching, and they’ll keep finishing the job where your sensors were never installed.

Sources

• Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files
• Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes
• Citrix Patches 10 Critical NetScaler Vulnerabilities
• Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure