Signs Detected of Global Cyberattack Preparations by North Korea's Lazarus Group

Exploiting PHP Vulnerability... Government Agencies and Financial Institutions Among Key Targets

Signs have emerged that a group suspected of being linked to North Korean hackers is preparing a large-scale cyberattack targeting government agencies and financial institutions around the world. However, no evidence has yet been found directly linking the group to Lazarus Group, North Korea's best-known hacking organization.

Pixabay

According to the cybersecurity industry on October 24, Singapore-based cybersecurity firm CYFIRMA said in a report released on October 23 that a Korean-speaking hacking group was preparing cyberattacks by exploiting security vulnerabilities in PHP, a programming language.

CYFIRMA detected signs that the group was discussing its attack plans on I2P, a closed network that ensures anonymity. The group is believed to have discussed preliminary reconnaissance and detailed plans to attack web servers around the world using the recently discovered PHP2Shell vulnerability.

PHP is a server-side programming language widely used on websites around the world. PHP2Shell is a security flaw that allows commands to be executed on a server remotely without a separate login or authentication process. It received a score of 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS), placing it in the critical severity category.

The group selected government agencies and financial institutions, including banks, as its initial targets. Manufacturing, logistics and shipping, aviation, online trading platforms, trading companies, and construction firms were also included among the targets.

The regions mentioned as targets included South Korea, the United States, Japan, Australia, Taiwan, India, Singapore, the United Arab Emirates (UAE), Saudi Arabia, and the European Union (EU).

Signs were also found that artificial intelligence (AI) was being used in preparations for the attack. The group reportedly collected publicly available exploit code, used its own AI model to prioritize targets, and tested the code in a controlled environment before putting it to actual use.

CYFIRMA named the activity the "June 2026 Minjun" campaign and raised the possibility that the hacking group was linked to North Korea's Lazarus Group. However, it rated the confidence level of its analysis regarding a link to North Korea as "medium."

Cybersecurity experts have also cautioned that the findings should be treated carefully. Although the attack plans were discussed in Korean and the tactics resembled methods previously used by Lazarus, they say it is difficult to confirm North Korean involvement on that basis alone. In particular, no evidence of overlapping malware or attack infrastructure directly linking the group to Lazarus has been found.

This content was produced with the assistance of AI translation services.