Hackers believed to be linked to North Korea are preparing to exploit serious security vulnerabilities in the PHP programming language. South Korea has been identified as the primary target in their initial attack list.
According to Cipherma, a cybersecurity threat analysis firm based in Singapore, two Korean-speaking operators were captured discussing their plans on a private channel of the anonymous network 'I2P' for 31 minutes starting at 11 a.m. on October 22.
The conversation included specific operational guidelines. The operators decided to quietly collect information on PHP versions exposed by servers without conducting large-scale scans and instructed to avoid targets that appeared to have strong security monitoring. Servers that received security updates on October 21 were marked and excluded from their attack list.
They opted to use existing proof-of-concept attack codes rather than creating new ones, prioritizing them based on effectiveness using their own AI, and planned to validate them in a controlled testing environment. The conversation revealed 15 server addresses (IP) prepared for the attacks.
The targets are categorized into three tiers. The top tier includes government agencies and financial institutions in South Korea, the United States, Japan, the United Arab Emirates (UAE), the European Union (EU), Thailand, Indonesia, and Saudi Arabia. The second tier encompasses manufacturing, logistics, shipping, and airport and aviation sectors, while online payment and trading platforms, as well as construction companies, fall into the third tier.
The most likely method of infiltration involves cleverly manipulating requests to upload files to servers, allowing commands to be executed without logging in. Locations using Apache web servers with PHP as the default connection method are considered the most vulnerable. Various attacks are anticipated, including selling server access, stealing virtual assets, preparing ransomware attacks, and extracting account information. There may also be state-sponsored information gathering activities.
Cipherma has identified that these operators have been active on the same channel since March of this year. Even after the PHP development team released security updates on October 21, they continued to refine their attack target list by filtering out updated servers. Cipherma indicated that October 25 would be the next review date for the initial draft of the target list.
PHP2Shell has already become a target among general hackers. Amazon's security team detected the first attack attempt on October 17, and Cloudflare reported that there were millions of attack attempts by October 22.
Given that South Korea is the top priority, a proactive government response is urgently needed. There are no official security updates for PHP versions below 8.1, so the government must conduct a thorough inspection to determine whether public and financial servers are using these versions and provide support for updates or external network separation.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.