Key points
- CYFIRMA says the hackers rank attack code with AI
- AhnLab's pre-patch count flags 112,183 Korean hosts
- Korean experts question CYFIRMA's North Korea evidence
Korean-speaking hackers discussed plans to attack government agencies and banks in South Korea and other countries using two newly patched website software flaws, according to CYFIRMA, a Singapore-based cybersecurity firm. The firm suspects ties to North Korea's Lazarus Group, but Korean security experts say the evidence doesn't establish that link.
The flaws, known as PHP2Shell, affect PHP, software used to run websites. Fixes were released on October 21. CYFIRMA says it observed the hackers discussing targets the following morning, though they gave no date for launching attacks.
Before the fixes were released, Korean cybersecurity company AhnLab (안랩) identified 112,183 internet hosts in South Korea that appeared to run vulnerable PHP versions. That put the country sixth in its worldwide count, with 4.35 percent of the total. The estimate doesn't show how many systems remain vulnerable or have been breached. As of October 23, no breach or suspected damage from the flaws had been confirmed in Korea.
CYFIRMA watched the group plan in a closed chat channel
CYFIRMA says it found the plan by monitoring a closed channel on I2P, an anonymous network. It named the activity the June 2026 Minjun campaign after the channel. For about half an hour on October 22, two of the channel's handlers talked in Korean about which sectors and countries to go after. Korea is one of 11 target countries, along with the US and Japan, and the European Union is on the list too. After government agencies and banks come logistics, ports, airports, manufacturing, and construction. The group gave itself until October 25 to finish its first filtered list of targets.
The group is also using AI. CYFIRMA says the members collect public proof-of-concept code, which shows how a flaw can be attacked, rank it with their own AI model, and test it in a lab before they use it. In CYFIRMA's English translation of the chat, one line reads "AI is only for speed on sorting and validation of open material."
"This is the first case CYFIRMA has observed of an actor planning deliberate, sector- and country-prioritised targeting of PHP2Shell, with government and financial institutions first," the advisory said. Until now, public data had shown broad attack attempts that nobody had tied to a particular group.
The North Korea link isn't proven
CYFIRMA says its Lazarus assessment rests on behavior and language, not on shared malware or shared attack servers. Moon Jong-hyun (문종현), who heads the security center at Korean security company Genians (지니언스), said he understands how a foreign firm might have made that connection.
"Since it's an overseas security company, I can fully understand how it might have linked this straight to North Korea," Moon said. "You have to look at the code of the malicious program used in the attack, the IP addresses, and the tactics, and judge all of it together."
Another Korean security expert, who wasn't named, said CYFIRMA's evidence comes down to attack orders written in Korean, targets centered on government and financial institutions, and tactics that look like the web shells Lazarus has used before. A web shell is a small program that lets an attacker control a server from far away. "There's no confirmed evidence of overlapping malware or attack infrastructure that connects directly to the Lazarus Group," the expert said.
PHP runs most of the Korean web
PHP is everywhere on the Korean web. Among Korean-language websites whose programming language can be identified, 78.1 percent use PHP, based on W3Techs figures as of October 19. Gnuboard and Rhymix, two homegrown tools that many Korean sites use to build homepages and message boards, both run on PHP.
Older sites are the weakest spot. AhnLab says many small sites that have run for a long time were slow to get updates. "Systems that have been running old versions of PHP need to be checked first, because attackers can take over the server, install a web shell, or steal information," said Lee Myung-soo (이명수), who leads AhnLab's A-First team.
Updating isn't simple for everyone. PHP 8.1 and older versions no longer get official security fixes, so the government told operators who can't update to consider blocking outside access or taking the service offline for a while.
The government raised its cyber alert to caution
The Ministry of Science and ICT (과학기술정보통신부) raised its private-sector cyber crisis alert from "attention" to "caution" at noon on October 22. It added incident response staff and sent the warning to about 28,000 companies that have registered a chief information security officer.
The Ministry of the Interior and Safety (행정안전부) found no PHP use in the 217 information systems it runs, most of which use Java. Some websites run by local governments and their agencies may still use PHP, so the ministry sent them urgent notices to check.
Hosting companies moved early. Cafe24 (카페24) put temporary defenses on its servers running PHP 5.4 and later from 11:30 a.m. on October 21, before the official patch came out. Gabia (가비아) started emergency patching at midnight on October 22.
The alert comes in a month when Korea was already dealing with a data breach at Shinhan Bank and other lenders, which is a separate case.
Korean security stocks moved before the North Korea report
Korean security stocks moved sharply on October 23, the day after the alert went up. By our calculations, MonitorLab (모니터랩) rose nearly 30 percent during the session and closed up 13 percent. AhnLab rose almost 9 percent at one point, but it closed down 10.1 percent.
CYFIRMA's warning reached the Korean press on October 24, after the market had closed for the week, so October 26 is the first trading day since the report. In September, three Korean security stocks rose the full 30 percent daily limit after Nvidia's Jensen Huang talked about cybersecurity.
Meanwhile, CYFIRMA says it's still monitoring the channel.
The comments from Moon Jong-hyun, Lee Myung-soo, and the unnamed expert are translated from Korean. CYFIRMA's advisory and its translation of the chat are quoted in their original English.
