North Korean Hacking Group Targeted 581 Servers Worldwide... South Korean Government Also in Its Sights

CYFIRMA Report Confirms South Korean Servers on Target List
Targets Expand from Government, Finance and Telecom to Manufacturing and Logistics

Hackers believed to be affiliated with Lazarus, a group reportedly linked to North Korea's Reconnaissance General Bureau, have been found to have attempted large-scale cyberattacks targeting South Korean government agencies, financial companies, telecommunications and infrastructure facilities. The hackers are expanding their attacks to internet servers worldwide, and 30 servers in South Korea were also included on the target list.

Global cybersecurity firm CYFIRMA reported this in its report, "Analysis of Real-World Exploitation of the PHP2Shell Vulnerability and Risk of Damage," released on November 4.

According to the report, CYFIRMA confirmed that a Korean-speaking hacking group discussed plans on I2P, an anonymous network, to exploit security vulnerabilities in PHP software. The group selected government agencies, banks, financial companies, and telecommunications and infrastructure operators as its primary targets. Manufacturers, logistics and shipping companies, airports, and online payment providers were also among the targets.

Photo is not directly related to the article. Pixabay.

The vulnerabilities used in the attacks were two security flaws known as "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619). PHP is a programming language widely used to develop server-side programs for websites and online services around the world. Exploiting these vulnerabilities allows attackers to execute server commands remotely without any authentication. The severity of both vulnerabilities was rated 9.2 out of 10.

The initial list of targets obtained by CYFIRMA consisted of 216 internet-connected servers in 10 countries. By country, the list included 49 servers in the United States, 47 in Japan, 31 in India, and 30 in South Korea. The hackers searched for targets through 21 compromised servers. Investigators found that they slowed their attacks and changed their relay servers to evade detection and blocking.

The hackers claimed to have attempted to exploit the vulnerabilities between October 25 and 29 and said they had expanded the number of targets from 216 to 581. However, the figure of 581 was the number claimed by the hackers.

CYFIRMA assessed with a high degree of confidence that the group behind the preparations was potentially linked to Lazarus, a state-sponsored hacking group backed by North Korea. The assessment was based on activity by Korean-speaking users, North Korean-style vocabulary, infrastructure previously used by Lazarus, and tactics targeting financial institutions. The attacks were assessed as having both intelligence-gathering and financial theft objectives.

CYFIRMA recommended that organizations and companies operating PHP servers exposed to the internet apply security updates and check their server logs.

This content was produced with the assistance of AI translation services.