Hackers Exploit Check Point Firewall Flaws to Gain Root Access and Deploy Wiper Malware on VMware ESXi

Attackers chained multiple Check Point firewall vulnerabilities to escalate privileges to root, plant persistent backdoors, and ultimately deploy destructive wiper malware on VMware ESXi hypervisors — a critical layer of infrastructure. The campaign affected dozens of customers across multiple software releases (R81–R82.20), indicating that many organizations had not applied available patches in a timely manner. Security appliances such as firewalls are high-value targets precisely because they sit at the perimeter and, when compromised, grant attackers deep network access. Chaining privilege escalation flaws with destructive payloads on hypervisors can wipe entire virtualized environments in one campaign, magnifying the blast radius significantly. This incident underscores that network security devices are not immune to vulnerabilities and must be subject to the same rigorous patch and vulnerability management programs as any other system.