A group suspected to be linked to North Korea's Lazarus Group is preparing for large-scale cyber attacks by exploiting a security vulnerability in the PHP programming language, which is widely used across global websites.
According to cybersecurity firm CYFIRMA based in Singapore, discussions among Korean-language users on the anonymous network I2P regarding plans to exploit PHP vulnerabilities have been detected.
These individuals are believed to have discussed reconnaissance and attack methods aimed at exploiting the recently discovered PHP2Shell vulnerability to target web servers worldwide.
PHP2Shell is a security flaw that allows remote command execution on servers through manipulated web requests without requiring separate login or authentication. It has been classified as critical, receiving a score of 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS).
Government agencies and financial institutions, particularly banks, are among the primary targets. Other sectors mentioned include manufacturing, logistics, shipping, aviation, online trading platforms, and construction companies.
Regionally, South Korea, the United States, Japan, Australia, Taiwan, India, Singapore, the United Arab Emirates (UAE), Saudi Arabia, and the European Union (EU) are prioritized for attacks.
Evidence has also surfaced indicating the use of artificial intelligence (AI) in the attack preparations. CYFIRMA explained that attackers are collecting publicly available proof-of-concept (PoC) exploit codes, prioritizing them using their own AI model, and validating them in controlled environments before actual attacks.
CYFIRMA has named this activity the 'June 2026 Minjun' campaign and suggested a possible connection to North Korea's Lazarus Group. However, the reliability of the analysis regarding this connection has been assessed as 'medium.'
In the cybersecurity community, there is caution regarding definitively attributing the attacks to a North Korean organization. Concerns arise from the lack of direct evidence linking the attacks to North Korea, despite the use of Korean-language directives and the targeting of government and financial institutions, which resemble previous Lazarus tactics.
Meanwhile, the PHP development team released an emergency security update addressing the vulnerability on October 21.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.