Check Point Research disclosed a campaign this week deploying a two-stage implant on VMware ESXi hypervisors. The first stage is a wiper that destroys data. The second stage is a persistent backdoor. Tool overlap with UNC5221, a China-nexus threat cluster, was confirmed. The exploit chain uses CVE-2026-109618, CVE-2026-109619, and CVE-2026-123039.
The two-stage implant
Stage one executes a wiper on the hypervisor before defenders can respond. Stage two installs a persistent backdoor that survives a hypervisor restart. The sequence is unusual: running a destruction capability first and then establishing persistence suggests either a multi-principal operation or a contingency design where the wiper executes if the backdoor cannot be established cleanly.
Check Point's disclosure includes indicators of compromise for both stages. Organizations should check for these before concluding they are unaffected.
What the UNC5221 tool overlap means
UNC5221 has been tracked since at least 2024 in campaigns targeting network edge devices and virtualization infrastructure. Tool overlap is not equivalent to attribution: shared tooling can enter the ecosystem via leaks, purchases, or access to common underground markets. However, the overlap is a signal that this campaign is operating at a sophistication level consistent with nation-state-adjacent actors.
For defenders, the practical implication is operational continuity from the threat actor. If your environment was targeted and you patched the entry-point CVEs without verifying you were not already compromised, you may still have an active implant.
Why hypervisor-level compromise is severe
Persistence at the ESXi hypervisor level sits below every guest operating system running on that hardware. A backdoor in ESXi survives a guest OS reinstall, a full disk wipe of a virtual machine, and all endpoint detection controls that operate at the guest layer. Detection requires hypervisor-level visibility that most organizations do not have. Standard EDR tools are blind to this class of implant.
What to do now
- Apply patches for CVE-2026-109618, CVE-2026-109619, and CVE-2026-123039 to all ESXi hosts. These patches are overdue if not already applied.
- Check for indicators of compromise from Check Point's disclosure before concluding your environment is clean. Patching stops new infections but does not remove an existing implant.
- Restrict ESXi management interface access to dedicated management VLANs. Enforce multi-factor authentication on all administrative accounts.
- If you do not have hypervisor-level security monitoring, evaluate ESXi-aware tooling. Guest-layer EDR is insufficient against implants at this level.
Written by Gigia Tsiklauri, Security Architect and AI Security specialist at Infosec.ge.