North Korean Hacking Group Lazarus Spotted Preparing Attacks Exploiting PHP Vulnerability

Circumstances indicate that preparations are underway for a large-scale cyber attack exploiting a critical security vulnerability in PHP, a programming language widely used for websites worldwide.

The perpetrator behind the attacks has been pointed to as a group linked to the North Korean state-sponsored hacking group Lazarus.

Singapore-based cybersecurity firm CYFIRMA detected Korean-speaking operatives plotting cyber attacks using the PHP vulnerability on I2P, an anonymous closed-source network.

They were found to have discussed preliminary reconnaissance and detailed attack plans to target web servers globally by utilizing the recently discovered PHP vulnerabilities known as 'PHP2Shell' (CVE-2026-109618, CVE-2026-109619).

PHP2Shell is a flaw that allows attackers to remotely execute commands on a server through manipulated web requests without separate login or authentication procedures. It received a rating of 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS), classifying it as 'critical'.

CYFIRMA named this attack preparation activity the 'June 2026 Minjun' campaign, raising the possibility that the related organization belongs to or is linked with the North Korean Lazarus Group ecosystem.

However, the confidence level for the North Korean linkage was evaluated as 'moderate'.

According to the attack plans identified by CYFIRMA, they selected government agencies and financial institutions, including banks, as their top priority targets.

Manufacturing, logistics and shipping, airports and aviation, online trading platforms, trading companies, and construction firms were also found to be included in the targets.

By region, South Korea, the United States, Japan, Australia, Taiwan, India, Singapore, the United Arab Emirates (UAE), Saudi Arabia, and the European Union (EU) were mentioned as primary targets.

Circumstances of utilizing artificial intelligence (AI) during the attack preparation process were also confirmed.

CYFIRMA explained, "They are preparing attacks in a meticulous manner, such as collecting publicly available proof-of-concept (PoC) exploits, prioritizing them with their own AI model, and verifying them in a controlled environment before actual use."

At the same time, some analyses suggest that there is insufficient evidence to directly connect this attack preparation group to North Korea's Lazarus Group.

Meanwhile, PHP is a server-side programming language used by a significant portion of websites worldwide, and the PHP development team distributed an emergency security update patching this vulnerability on October 21.

The Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) issued a 'Caution' alert regarding the PHP vulnerability on October 22 and guided companies on security response guidelines.
※ Please note: This article was translated by AI and may contain errors.