CERT24PHP2Shell vulnerabilities exploited to erase data from VMware ESXi serversLoading data…
CERT24Threat Observatory
Period

PHP2Shell vulnerabilities exploited to erase data from VMware ESXi servers

Attackers targeted vulnerable Check Point Security Gateway instances to deploy data-wiping malware on VMware ESXi hosts. The first wave began on October 30 and targeted Israeli organizations; a second wave on November 2 affected companies in multiple countries and sectors. The second wave did not include destructive activity.

← Back to intelligence

PHP2Shell vulnerabilities exploited to erase data from VMware ESXi servers

Attackers targeted vulnerable Check Point Security Gateway instances to deploy data-wiping malware on VMware ESXi hosts. The first wave began on October 30 and targeted Israeli organizations; a second wave on November 2 affected companies in multiple countries and sectors. The second wave did not include destructive activity.