Security firm's report includes hacker chat logs; 'Korean IPs look promising'

Government, financial sectors among targets; experts urge system patch and restart

The lobby of the Financial Investment Center Building in Yeouido, Seoul, which houses the Financial Security Institute, a cybersecurity agency under the Financial Services Commission. The institute was found to have been breached in a hacking attack, with hundreds of records including personal information believed to have been leaked. [Yonhap]
The lobby of the Financial Investment Center Building in Yeouido, Seoul, which houses the Financial Security Institute, a cybersecurity agency under the Financial Services Commission. The institute was found to have been breached in a hacking attack, with hundreds of records including personal information believed to have been leaked. [Yonhap]

A global cybersecurity firm has confirmed that Lazarus, a hacking group linked to North Korea's Reconnaissance General Bureau, identified IP address ranges across six countries — including South Korea — as "promising" attack targets. South Korean servers and domains accounted for 30 of the group's specific targets.

Lazarus is believed to operate with the aim of stealing funds from financial institutions and gathering classified information from governments and corporations. Global threat intelligence firm Cyperma disclosed the findings in an updated report on the exploitation of PHP2Shell vulnerabilities, published earlier this month.

Dark web chat logs included in the report show that on Oct. 28, the hackers were scouting targets and sharing scan results, saying that "some IP ranges in South Korea, Japan, the United States, Thailand, Indonesia and India look quite promising." Cyperma assessed that the group was not conducting random attacks but was specifically pursuing financial theft and intelligence collection.

According to Cyperma, the hackers discussed infiltrating PHP-based web servers across seven industry sectors in the targeted countries: government agencies, banks and financial institutions, telecommunications, critical infrastructure, logistics and aviation, manufacturing, and online transaction platforms. Shortly after those conversations, they deployed additional scan nodes against IP ranges in the countries they had flagged as promising.

The target list obtained by Cyperma covered 216 exposed servers across 10 countries. Of those, 30 were servers and domains based in South Korea — placing the country among the most heavily targeted, behind Japan and the United States.

The attackers exploited remote code execution vulnerabilities in the PHP core running on Windows operating systems — tracked as CVE-2026-109618 and CVE-2026-109619. Cyperma noted that these are flaws in the PHP runtime itself, not in web applications.

North Korean operators used 21 pre-compromised scan nodes as staging points to deploy web shells — malicious scripts — onto target servers. They then stole administrator credentials and moved laterally through internal networks, expanding their reach to a total of 581 hosts.

To prevent secondary breaches at affected organizations, Cyperma redacted the fourth octet of the IP addresses of the 30 South Korean targets before publishing the report. The firm again emphasized that the vulnerabilities exploited were in the PHP runtime itself, not in web application software.

"Simply updating web applications is not sufficient for defense," Cyperma said in the report. "System administrators must patch the PHP core itself and then fully restart all web worker processes to block web shell infiltration."


andy@heraldcorp.com