Morning Threat Brief: Check Point gateways hacked to root with a wiper waiting, ransomware wipes a VMware estate with no hypervisor bug, the FBI disrupts a $400M fake video call scam, and AI agents break in under three hours

Good morning. Attackers chained two PHP flaws to a brand new Check Point zero-day to take root on security gateways, then moved to VMware hosts and ran a data wiper. A ransomware gang wiped an entire virtualization estate in ten days without exploiting a single hypervisor bug, using only stolen credentials and VMware's own management tools. The FBI seized the cloud infrastructure behind a North Korean fake video call scam that stole more than $400 million in crypto. And the FBI warns an AI pentesting framework is now automating break-ins that reach privileged access in under three hours. If you run Check Point gateways or VMware, check them first thing today.

01  A Check Point zero-day joins CISA's exploited list, and the attacks behind it already wiped VMware hosts

CISA added CVE-2026-123039 to its Known Exploited Vulnerabilities catalog on November 13, with a fix deadline of Monday, November 16. The flaw sits in the Gaia OS DynamicCLI service: the daemon runs as root and listens on a world-writable local socket without authenticating who connects, so any local user can send it a command and have it run as root. Check Point says attackers chained it to PHP2Shell, two critical PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619 that allow unauthenticated remote code execution through the Mobile Access portal. The first wave started October 30 against Israeli organizations, and a second wave on November 2 hit companies in several countries. Once in, the attackers installed PHP webshells and a backdoor called TSGA, then used SSH from the gateway to reach VMware ESXi hosts and ran a wiper called destroy_v6 that deletes files and leaves a political note named DREAM_ANNEXATION.txt. Check Point says about two dozen customers were compromised.

Attribution is uncertain: the tooling resembles PhiliKit, previously linked to the China-nexus cluster UNC5221, but Check Point says the evidence does not support a confident attribution and a false flag is possible.

02  Ransomware wiped an entire VMware estate in ten days without one hypervisor bug

Kaspersky's Global Emergency Response Team documented a BlackNevas intrusion that destroyed four ESXi hosts, every virtual machine on them, both vCenter Server Appliances, and all connected backup infrastructure. The attackers used no guest-to-host escape and no hypervisor memory corruption: every action ran through legitimate VMware management interfaces, so the intrusion looked like routine administration. It started with stolen administrative credentials, then the attackers used vCenter Host Profiles, a compliance feature, to switch SSH on across the hypervisors and log in directly from the trusted vCenter appliance. They installed a Ligolo-ng tunnel disguised as a systemd service named vmware-vdma, beaconing to api.cloudvflare.com, then delivered a wiper over SFTP and ran it. Every virtual machine stopped within 23 seconds, and the first 2 KB of each virtual disk was overwritten, destroying the boot records. The victim was running unsupported ESXi builds.

03  The FBI seized the infrastructure behind a $400 million fake video call scam

The Justice Department announced on November 12 that it seized cloud infrastructure used in FaceStealer, a North Korean social engineering scheme that stole more than $400 million in cryptocurrency over 18 months. The FBI attributes it to a group tracked as Sapphire Sleet, UNC1069, Stardust Chollima, APT38, and BlueNoroff. The scheme works like this: attackers use accounts stolen from earlier victims to invite their contacts to video meetings, then impersonate a trusted person on the call and talk the victim through fake troubleshooting steps that install malware. The FBI seized more than 900 webcam videos of victims under a federal warrant. In the same announcement, the Justice Department obtained court authorization to seize or restrain more than $1.2 billion tied to a separate October 29 theft of more than $6 billion from Binance, attributed to a different North Korean cluster called TraderTraitor.

04  The FBI warns an AI pentesting framework is breaking into networks in under three hours

FBI FLASH-20261113-001, dated November 13, warns that hackers are using ARTEX, an open-source AI penetration testing framework, to automate intrusions from reconnaissance through data theft. ARTEX is a multi-agent platform written in Go that turns plain-language objectives into commands run by specialized agents. It ships with no AI model of its own and connects to outside providers, including Claude, GPT, DeepSeek, GLM, Grok, and Kimi. Some intrusions went from first targeting to privileged access in under three hours. The framework was released on GitHub in July 2026 by a developer using the name Autumn-27 and pulled on October 8 after abuse reports, but it still circulates through forks and copies, and researchers found more than 1,600 exposed ARTEX consoles in early November. Two campaigns stand out: financially motivated attacks on South Korean financial institutions that exposed personal data on about 67,000 people, and a ConnectWise Cloud Backup supply chain compromise that Microsoft linked to the China-aligned group Storm-0940, reaching more than 2,250 downstream customer environments.

Warning: two exploited flaws hit their fix deadline on Monday, November 16: the Check Point zero-day CVE-2026-123039 and the UnrealIRCd flaw CVE-2026-114713, both added to CISA's exploited list yesterday. The Barracuda and Ivanti deadlines passed yesterday, Friday, November 13, so treat any unpatched Barracuda Email Security Gateway or Ivanti install as exposed. The Apple KEV entry CVE-2024-27834 is due Wednesday, November 18, the SonicWall SSL-VPN flaw CVE-2026-19868 is due Friday, November 20, and the four new KEV entries from November 10, including the Outlook and Chrome zero-days, are due Tuesday, November 24.

Two new CISA KEV entries today: CVE-2026-123039 (Check Point) and CVE-2026-114713 (UnrealIRCd), both added November 13 and due Monday, November 16. The catalog stands at 1,781 entries.

Back to the brief