Science & Tech · Cybersecurity · 3 hrs ago
North Korea-linked hackers targeted 30 South Korean servers
The Lazarus hacking group targeted 30 South Korean servers and domains, according to cybersecurity firm Cyfirma.
The group is linked to North Korea and has been associated with stealing money from financial institutions and gathering secret information.
Hackers discussed targeting South Korean internet address ranges, along with ranges in Japan, the United States and other countries.
They focused on PHP-based servers in seven sectors, including government, finance, telecommunications and critical infrastructure.
The attackers exploited vulnerabilities in PHP, software used to run websites on some Windows systems, and tried to install malicious scripts called web shells.
They also sought administrator credentials and tried to move through connected systems, expanding the target list to 581 hosts.
The activity could expose organizations to theft and espionage, though the account does not say how many systems were breached.
Cyfirma advised system administrators to patch PHP itself and fully restart web processes to block the web shells.
A report says the North Korea-linked hacking group Lazarus targeted 30 servers and domains in South Korea.
The targets were among 216 exposed servers across 10 countries identified in a list obtained by cybersecurity firm Cyfirma.
Hackers discussed targeting PHP-based web servers in government, finance, telecommunications and four other major industries.
The attackers exploited remote code execution vulnerabilities in PHP running on Windows systems, according to Cyfirma’s analysis.
Cyfirma said system administrators should patch the PHP core and fully restart web worker processes to block web-shell intrusions.
- Who
- Lazarus, a hacking group linked to North Korea’s Reconnaissance General Bureau.
- What
- It targeted 30 South Korean servers and domains using PHP vulnerabilities.
- When
- The hackers discussed promising IP ranges on October 28; Cyfirma published an updated report earlier in November.
- Where
- South Korea, among targets across 10 countries.
- Why
- The activity was aimed at financial theft and intelligence gathering, according to the report’s analysis.
This story does not have two clearly opposing sides.
Hackers discussed scan results and said some South Korean, Japanese, US, Thai, Indonesian and Indian IP ranges looked promising.
The hackers added scan nodes to IP ranges they considered promising.
Cyfirma published an updated report on exploitation of the PHP2Shell vulnerability.
Yonhap reported that analysis of the target list identified 30 South Korean servers and domains.
- South Korean targets
- 30 servers and domains
- Target list
- 216 exposed servers across 10 countries
- Scan nodes
- 21 IP addresses
- Expanded target set
- 581 hosts
- Vulnerabilities
- CVE-2026-109618 and CVE-2026-109619
1 source
What people are saying
Simply updating the website application is not enough to defend against this.
System administrators must patch the PHP core itself and completely restart all web worker processes to block web-shell intrusions.