Critical Check Point VPN Zero-Day (CVE-2024-24919) Exploited in Global Espionage Campaign

Executive Summary\nOn July 30, 2026, security researchers and Check Point Software Technologies confirmed active exploitation of a zero-day vulnerability, designated CVE-2024-24919, which affects a wide range of Security Gateway products. This critical information disclosure flaw allows unauthenticated attackers to gain access to sensitive files on gateways that have the Remote Access VPN or Mobile Access blades enabled. Given the ubiquity of Check Point infrastructure in enterprise environments, the vulnerability presents a significant risk to global supply chains and government communications. Immediate remediation is required to prevent unauthorized network entry and credential harvesting.\n\n## Threat Analysis\nThe exploitation of CVE-2024-24919 appears to be part of a coordinated campaign targeting edge networking devices to establish persistent access. Threat actors are utilizing this vulnerability to read internal system files, specifically targeting the /etc/shadow file to extract password hashes of local accounts. These accounts, often overlooked during standard security audits or missing multi-factor authentication (MFA), become the primary point of failure. Once the hashes are cracked or replayed, attackers can authenticate as legitimate administrators, bypassing perimeter defenses. The activity demonstrates a high level of technical proficiency and a focus on long-term espionage rather than immediate disruptive action.\n\n## Technical Details\nThe vulnerability is an arbitrary file read flaw located in the web management and VPN portals of affected Check Point gateways. It stems from improper validation of input paths in specific HTTP requests. An attacker can use directory traversal techniques to access files outside the restricted web environment. Affected versions include Quantum Maestro, Quantum Scalable Chassis, and Spark appliances across several firmware branches (R81.20, R81.10, R80.40). The lack of complex prerequisites for exploitation—requiring only network visibility to the gateway—elevates the risk. Check Point has issued a "Preventative Hotfix" that restricts access to the vulnerable endpoints and adds additional validation layers to prevent traversal attempts.\n\n## Attribution Assessment\nAnalysis of the exploitation patterns and post-compromise behavior indicates the involvement of a sophisticated threat actor. Intelligence gathered by Mandiant and Microsoft MSTIC suggests the tactics, techniques, and procedures (TTPs) align with a group tracked as UNC5537, a suspected state-sponsored entity. The focus on high-value targets within the telecommunications and defense sectors in Europe and North America further supports a nation-state attribution. While the group's specific geographic origin is still being verified, their operational hours and infrastructure selection point toward an Eastern European or Central Asian base of operations.\n\n## Implications\nThe emergence of CVE-2024-24919 underscores the ongoing trend of threat actors targeting critical "edge" infrastructure. As organizations harden their internal endpoints, the perimeter—specifically VPNs and firewalls—remains a primary target. The ability for an unauthenticated user to read sensitive system files remotely is a worst-case scenario for network administrators. If left unpatched, this vulnerability could serve as a gateway for massive data breaches, ransomware deployment, or deep-seated espionage campaigns that remain undetected for years.\n\n## Recommendations\nEncrygma Intelligence advises all clients to take the following steps: First, verify if your Check Point Security Gateway has the Remote Access or Mobile Access blades enabled. Second, immediately apply the security hotfix provided by Check Point for your specific version. Third, once patched, perform a comprehensive audit of all local accounts on the gateway and change their passwords, especially if those accounts were used for management purposes. Fourth, prioritize the implementation of MFA for all VPN connections and restrict management access to trusted IP ranges only. Finally, scan system logs for any unusual web requests directed at internal file paths or signs of unauthorized file access occurring before the patch was applied.