Check Point reports intrusions through internet-facing gateways that reached VMware ESXi systems, while an international operation disrupted infrastructure used by Gootloader and StealC.
A campaign exploiting Check Point security gateways has put VMware ESXi infrastructure at risk, with destructive activity reported in a limited number of intrusions. Check Point said it observed exploitation of unpatched systems and notified affected customers. The company’s researchers described activity beginning in late October and a broader wave in early November, but said the later wave showed no evidence of destruction.
The attackers targeted internet-facing Mobile Access portals. Reports describe PHP-related exploitation and a Check Point gateway flaw used to gain access, followed by PHP webshells and backdoor components. From compromised gateways, attackers moved to ESXi hosts, using SSH access through the vpxuser service account. The activity included tools intended to conceal attacker traffic.
In some cases, attackers deployed a wiper that recursively deleted files and could overwrite them first, making recovery harder. A message found in the operation rejected ransom negotiations, consistent with sabotage rather than ordinary extortion in those incidents. Check Point has not reported that all affected systems were destroyed, and the available information does not establish that the campaign was widespread.
Check Point recommends installing its November Jumbo Hotfix on all Management Servers and Security Gateways, prioritizing systems with internet-facing Mobile Access deployments. The company said fixes had been available since October 23. CISA added the exploited gateway vulnerability to its Known Exploited Vulnerabilities catalog on November 13, another reason administrators should treat this as an urgent patch rather than routine maintenance.
Patching does not remove an attacker who may already have established persistence. Teams should inspect gateway and firewall logs for unexplained gaps, look for unexpected PHP session files and processes, and review unfamiliar files in temporary directories. Check Point’s researchers also identified rogue processes and scanner activity as clues to investigate. Administrators should compare findings with vendor guidance rather than assume every suspicious-looking artifact proves compromise.
Because the reported chain reached ESXi, teams should review hypervisor authentication and service-account activity, including SSH use by vpxuser that does not match normal maintenance. Check for unexplained file changes and verify that backups are isolated and recoverable. If compromise is suspected, isolate affected systems where operationally feasible and engage incident-response support. A hotfix is necessary, but it is not a substitute for investigating access that may have occurred before installation.
Check Point linked some of the tooling to modified PhiliKit components previously associated with attacks on Ivanti products and with the China-nexus group UNC5221. The company said the evidence does not support high-confidence attribution; false-flag activity or an initial-access broker remain possible. That uncertainty is a reason to focus on observable indicators and remediation, not to treat a suspected actor connection as confirmed.
Separately, an international law-enforcement operation disrupted infrastructure associated with Gootloader, StealC and CastleRAT, according to the Justice Department material in the source report. Authorities said they dismantled servers and domains used by the malware operations. The Justice Department reported that more than 44 U.S. ransomware victims were initially infected through Gootloader and estimated losses at $28.8 million. The operation also targeted more than 100 StealC servers and identified millions of stolen login credentials.
A takedown can disrupt criminal operations, but it cannot clean infected machines or make stolen passwords safe. IT teams should review endpoint alerts and telemetry for Gootloader or StealC activity, reset credentials where theft is suspected, revoke active sessions and tokens, and require multifactor authentication where available. Developers and administrators should rotate secrets from a clean device if they may have been stored on an affected endpoint.
The source material also refers to a cloud-provider ransomware incident and a cloud-supply-chain data breach, but supplies no details about the providers, affected customers or response. Those claims cannot be assessed from the information available. For small IT teams, the immediate priorities are concrete: patch exposed gateways, investigate persistence and lateral movement, review virtualization infrastructure, and respond quickly to suspected credential theft.
Ryan Mitchell serves as a Staff Writer for Just Right News, where he anchors the desk for Cyber, Technology Policy, and Digital Sovereignty. In an era where the digital landscape has become as much a battlefield as any physical territory, Ryan provides a critical conservative lens on the forces shaping the future of American innovation and national security. His work is defined by a commitment to the idea that American leadership in the digital age is not just a matter of economic success, but a necessity for the preservation of global liberty.
Born and raised in Austin, Texas, Ryan’s perspective is deeply rooted in the Lone Star State’s tradition of independence and skepticism of centralized authority. Growing up in a city that transformed from a quiet state capital into a global technology hub, he witnessed firsthand the disruptive power of the tech industry. This upbringing instilled in him a firm belief in free-market principles and the necessity of protecting individual liberties from both government overreach and corporate overstep. His Texan background serves as a foundational compass, guiding his reporting toward stories that emphasize national resilience and the preservation of constitutional values in an increasingly virtual world.
Now based in San Francisco, California, Ryan operates from the epicenter of the very industry he scrutinizes. Living and working in the heart of Silicon Valley allows him to provide “boots on the ground” reporting that few conservative journalists can match. He navigates the cultural and political complexities of the Bay Area to bring Just Right News readers an inside look at the boardrooms and coding labs where the next generation of digital policy is forged. For Ryan, being stationed in San Francisco is a strategic choice; it allows him to challenge the prevailing ideological monoculture of the tech elite from within their own backyard, ensuring that the concerns of middle America are represented in the conversation about our digital future.
His beat—Cyber, Technology Policy, and Digital Sovereignty—covers the high-stakes world of data privacy, artificial intelligence, and the infrastructure of the modern web. Ryan is particularly focused on the concept of digital sovereignty, arguing that for a nation to remain truly free, it must maintain control over its own technological destiny and critical infrastructure. He frequently explores how international regulations and domestic policies impact the ability of American firms to compete without sacrificing the privacy or security of their citizens.
Central to his current body of work is his featured series, “The New Cold War.” Through this project, Ryan examines the escalating technological rivalry between the United States and its global adversaries. He delves into the complexities of state-sponsored hacking, the global race for semiconductor dominance, and the ideological struggle to define the rules of the internet. Ryan views this competition not merely as a commercial race, but as a fundamental defense of Western values against authoritarian digital models. Through his rigorous reporting and principled analysis, Ryan Mitchell ensures that the readers of Just Right News stay informed about the invisible forces defining the 21st century, always advocating for a future where technology serves the cause of freedom.