CheckMesh is a targeted intrusion in which an advanced actor compromised the Linux-based Check Point firewall of an Israeli enterprise and deployed a malicious ELF implant derived from MeshAgent. The implant converted the perimeter device into a covert command-and-control node, allowing the attacker to maintain hidden remote access from infrastructure that defenders ordinarily trust. The activity was assessed as more consistent with a capable APT than hacktivism, but no specific threat group or national sponsor was established.