SEOUL, October 24 (AJP) — A suspected North Korea-linked hacking operation is preparing cyberattacks against government agencies and financial institutions, including those in South Korea, by exploiting newly discovered weaknesses in software widely used to run websites.
Singapore-based cybersecurity firm CYFIRMA said it detected Korean-speaking operators discussing targets and attack preparations on a closed anonymous network on Thursday.
The firm said it was highly confident that an attack campaign was being prepared, but assessed only with moderate confidence that the operators were linked to North Korea's Lazarus Group.
At the center of the threat are two serious security flaws collectively known as PHP2Shell.
PHP is a programming language used behind the scenes by a large share of the world's websites. It handles tasks such as processing information sent through websites and communicating with servers and databases.
The newly discovered flaws can, under certain conditions, allow an attacker to send a specially crafted request to a vulnerable website and make its server carry out commands without first logging in.
That could give hackers a foothold to steal information, install malicious software or move deeper into a company's network.
The flaws received a severity score of 9.2 out of 10, and emergency fixes were released on Oct. 21.
CYFIRMA said the suspected attackers were no longer simply looking broadly for vulnerable websites but were sorting potential targets by country and industry.
Government agencies, banks and other financial institutions were listed as the highest priorities, followed by manufacturers, logistics and shipping companies, airports, online transaction services, trading firms and construction companies.
South Korea was among the countries singled out, along with the United States, Japan, Australia, Taiwan, India, Singapore, the United Arab Emirates, Saudi Arabia and several other markets.
The operators had already prepared 15 pieces of online infrastructure to support the campaign and were expected to complete an initial list of selected targets by Sunday, Oct. 25, according to CYFIRMA.
No specific date for an attack has been identified.
The security firm also detected 17 internet addresses on Friday attempting techniques similar to those expected in attacks using the PHP flaws.
It cautioned that those addresses have not been proven to belong to the same suspected North Korea-linked group.
Artificial intelligence also appears to be playing a role in the preparations.
CYFIRMA said the operators were collecting attack methods that had already been published by security researchers and using an AI model to decide which were most promising before testing them in a controlled environment.
Rather than inventing an entirely new hacking method, the group appeared focused on quickly turning publicly available information about the new security flaws into a usable attack.
The operators also discussed avoiding large-scale scans that could draw attention before their targets had been selected, the firm said.
CYFIRMA said the campaign was significant because government and financial organizations appeared to be deliberately targeted, rather than becoming random victims of hackers searching the internet for any vulnerable server.
Still, the firm stressed that the connection to Lazarus has not been proven.
Its assessment is based on the use of Korean in the intercepted discussions, the choice of government and financial targets and similarities to methods previously associated with Lazarus.
CYFIRMA said it had not found malware or online infrastructure that directly matched known Lazarus operations.
The warning comes as South Korean companies and financial institutions are already on heightened alert after a separate wave of hacking incidents.
Shinhan Bank, KB Kookmin Bank and Hana Bank were among financial firms that reported customer data leaks after attacks beginning in late September, while several other lenders detected and blocked intrusion attempts.
U.S. cybersecurity firm CrowdStrike assessed with moderate confidence that those attacks were carried out by a financially motivated actor likely to be a Chinese speaker. AI-assisted hacking tools were also found to have been used during the attacks.
There is no evidence connecting those incidents to the suspected North Korea-linked PHP campaign.
But the emergence of a separate possible state-linked threat adds to cybersecurity concerns among Korean companies and public institutions already dealing with repeated attempts to break into their systems.
South Korea raised its private-sector cyber crisis alert level from "Attention" to "Caution" this week after the PHP vulnerabilities became public.
The Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) have urged companies and institutions operating websites to install the latest PHP security updates immediately.
Older versions that no longer receive official security updates should be replaced, while servers that cannot be updated promptly should be isolated or have outside access restricted, authorities said.
The government has warned that the flaws could affect a large number of websites because PHP is so widely used.
CYFIRMA similarly advised organizations in the industries and countries identified by the suspected attackers to update their systems immediately and check whether there have been signs of intrusion since Oct. 17.
Copyright ⓒ Aju Press All rights reserved.
