Check Point zero-day exploited in wiper attacks; North Korea FaceStealer steals $400M crypto

Executive Summary

• Check Point Security Gateway instances are being exploited in a two-stage attack chain: first via patched PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619), then via a newly disclosed zero-day (CVE-2026-123039) to gain root; attacks began October 30 against Israeli organizations, where the intruders went on to deploy data-wiping malware on ESXi hypervisors, and a second wave on November 2 affected multiple countries without the destructive activity.
• The U.S. government disrupted infrastructure used by North Korean threat actors (BlueNoroff, in a scheme the FBI calls FaceStealer) who stole over $400 million in cryptocurrency over 18 months using fabricated and deepfake video calls, hijacked Telegram/Slack/LinkedIn/Discord accounts, and social engineering to trick victims into running malware.
• Agentic AI pentesting framework Artex is being deployed by multiple threat actors and nation-states to automate cyberattacks at machine speed, with the FBI warning that some intrusions progress from initial targeting to privileged access in under three hours.
• PostgreSQL released patches for 52 security flaws including a 22-year-old type confusion bug allowing authenticated RCE.
• Trezor hardware wallet manufacturer confirmed that three Safe 5 devices sold through Southeast Asian reseller CryptoBilis contained malicious implants designed to steal recovery phrases; firmware update 2.13.1 stops the implants found so far but cannot protect a recovery phrase that was captured before it was installed.

Top Threats Today

1. Check Point Zero-Day Exploitation Chain Deploying ESXi Data Wiper

Severity: CRITICAL   Affected: Technology

Vulnerable Check Point Security Gateway instances are being targeted in a multi-stage attack that chains two patched PHP remote code execution flaws (CVE-2026-109618 and CVE-2026-109619) with a newly disclosed zero-day privilege escalation (CVE-2026-123039) to achieve root access and deploy data-wiping malware on VMware ESXi hosts ^[1]. The campaign began on October 30, 2026, initially targeting Israeli organizations via the Mobile Access portal, with a second wave on November 2 affecting companies across multiple countries and sectors ^[1]. After gaining gateway access through PHP2Shell, attackers exploited CVE-2026-123039—a flaw in Check Point's DynamicCLI daemon running as root—to escalate to root privileges ^[1]. They then installed PHP webshells, the TSGA backdoor with TSProxy networking capability, and deployed the destroy_v6 wiper to recursively delete data from ESXi hosts ^[1]. In attacks on Israeli targets, threat actors used the gogo scanner to locate VMware ESXi systems and left a file named DREAM_ANNEXATION.txt containing political messages and explicitly rejecting ransom payment negotiations, which indicates that the attackers' goal was damage and disruption rather than extortion ^[1]. CVE-2026-109618 and CVE-2026-109619 were patched by PHP on October 21, though exploitation attempts began four days prior; CISA added both to its Known Exploited Vulnerabilities catalog on October 26 ^[1]. According to the researchers, the second wave did not include the destructive activity ^[1]. Check Point's November Jumbo Hotfix addresses both PHP2Shell and CVE-2026-123039, the DynamicCLI privilege escalation flaw used in the attacks ^[1].
Sources:[1] BleepingComputer

2. North Korean FaceStealer Campaign Steals $400M in Cryptocurrency via Deepfake Video Calls

Severity: HIGH   Affected: Finance   Technology

The U.S. Department of Justice and FBI have disrupted cloud infrastructure used by North Korean threat actors (tracked as BlueNoroff, APT38, and Sapphire Sleet) who, in a scheme the FBI calls FaceStealer, stole more than $400 million in cryptocurrency over the past 18 months ^[2]. The attack chain begins when threat actors gain access to a target's communication account (Telegram, Slack, LinkedIn, or Discord), then contact individuals in that person's network with invitations to video meetings on fake Zoom or Microsoft Teams websites ^[1]. During the fake call, attackers play prerecorded webcam videos of people known to the victim—or in newer variants, AI-generated deepfakes of well-known cryptocurrency industry figures—to build trust ^[2]. Posing as the video participant, the attacker then claims there is a meeting issue and directs the victim to run a script, click an update link, or paste commands into a terminal ^[1]. This installs malware capable of stealing browser cookies, logging keystrokes, capturing screenshots, and granting remote access; in some cases, attackers waited months before accessing cryptocurrency wallets, monitoring balances meanwhile ^[1]. The campaign has increasingly targeted open-source software developers and maintainers to gain access to repository accounts ^[1]. The FBI seized more than 900 webcam videos used for impersonation and warned that attackers have begun deploying AI-generated videos, though real victim recordings remain the primary method ^[1]. Concurrently, the Department of Justice announced seizure and restraint of more than $1.2 billion in cryptocurrency stolen by North Korea-linked TraderTraitor actors following the Binance exchange compromise ^[2].
Sources:[1] HackRead[2] The Hacker News

3. Trezor Hardware Wallet Implants Confirmed; Firmware Mitigation Released

Severity: HIGH   Affected: Finance

Cryptocurrency hardware wallet manufacturer Trezor has confirmed that three Safe 5 devices sold by Southeast Asian reseller CryptoBilis contained malicious hardware implants designed to steal wallet recovery phrases ^[1]. Trezor examined one device in its laboratory and identified two additional compromised wallets from customer-submitted photographs; all three were purchased between August 20 and September 23, 2026 ^[1]. The implant consists of an additional circuit board installed between the Safe 5's main board and display, allowing it to capture sensitive information without modifying the device's firmware or Secure Element ^[1]. When wallet recovery words appear on screen—either during new wallet backup or during restoration of an existing wallet—the implant collects them; it can also capture passphrases, encrypt the stolen data, and transmit it over cellular networks to an attacker-controlled server ^[1]. If a connection is unavailable, the implant retains the data and repeatedly attempts transmission until successful ^[1]. Trezor says 48 CryptoBilis customers have contacted the company following its October warning, with inspection of devices in the laboratory or via photographs; inspection of devices from other regional resellers has found no evidence of tampering ^[1]. To date, no affected customers have reported losing funds ^[1]. Trezor released firmware update version 2.13.1 (for Safe 5, Safe 7, Safe 3, and Model T) that stops the implants found so far from capturing anything, but the update cannot protect wallet backups that were compromised before the update was installed ^[2]. The company recommends moving funds to a new wallet with a new recovery phrase rather than restoring a potentially compromised phrase on another device ^[2].
Sources:[1] BleepingComputer[2] The Hacker News

4. Artex Agentic AI Framework Automating Multi-Stage Attacks at Machine Speed

Severity: HIGH   Affected: Government   Technology

The FBI has released a flash alert warning that the open-source Artex agentic AI penetration-testing framework is being deployed by cybercriminals and nation-states to automate cyberattacks against government agencies and dozens of critical sectors worldwide ^[1]. Artex can chain multiple attack techniques—from reconnaissance through data exfiltration—at machine speed with minimal human oversight; the FBI assessed that some intrusions progress from initial targeting to privileged access in under three hours ^[1]. The framework integrates with multiple large language models, including frontier commercial models (Anthropic Claude, OpenAI GPT) and open-source or Chinese models (DeepSeek, GLM, Grok, Kimi), with Chinese models the most prevalent on attacker-controlled instances and DeepSeek Flash family models dominating usage due to their balance of capabilities, relatively low cost, and lack of observable guardrails when framed for penetration testing ^[1]. Artex was released in August on GitHub by an account known as “Autumn-27”; the developer, identified as Chinese cybersecurity engineer Li Puhua, said in a statement on GitHub on October 8 that the tool was being abused and eventually removed the repository ^[1]. However, the framework continues to proliferate through community forks, localized variations, archived copies, and a commercial version ^[1]. Cybersecurity firm Censys documented over 1,600 publicly exposed Artex console instances, with actual deployments likely significantly higher when accounting for firewalled or private systems ^[1].
Sources:[1] The Record

5. PostgreSQL Patches 52 Flaws; 22-Year-Old Type Confusion Bug Allows Authenticated RCE

Severity: HIGH   Affected: Technology

PostgreSQL released security updates addressing 52 vulnerabilities, including a type confusion flaw dating back 22 years that allows a database user with object-creation privileges to execute code on the server ^[1]. Full protection from this flaw requires rebuilding any C-language extensions installed on the server ^[1].
Sources:[1] The Hacker News

Ongoing Coverage

Earlier briefings covered Microsoft Outlook zero-days and Git RCE in recursive clones, Apache HTTP/2 RCE, ScreenConnect worm malware, and GitHub account compromise campaigns. See November 13 briefing for continued context on Apache and GitHub threats.

Today's Action Checklist

• ☐ URGENT: Check Point customers: install the November Jumbo Hotfix; audit previously exposed Security Gateways for PHP2Shell and CVE-2026-123039 exploitation and the TSGA backdoor, and inspect ESXi hosts for the destroy_v6 wiper.
• ☐ URGENT: Cryptocurrency holders and software maintainers: enable MFA on messaging platforms; verify video call identities through independent channels before running scripts.
• ☐ URGENT: Anyone who bought a Trezor wallet from CryptoBilis since March 2026: move funds to a new wallet with a new recovery phrase and contact Trezor Support.
• ☐ HIGH: Monitor network logs for Artex-style rapid, multi-stage attack sequences; enforce MFA, credential segmentation, and JIT privilege access.
• ☐ HIGH: Apply latest PostgreSQL updates and rebuild C-language extensions; audit database user object-creation permissions.