A report by global cybersecurity firm Cyfirma indicates that North Korean hackers accessed 216 servers across 10 countries via two remote code execution vulnerabilities in PHP core on Windows environments.
A projection of code on a hooded man
REUTERS/YONHAP
North Korean hackers have targeted the South’s government agencies, financial institutions and its telecommunications sector, ICT industry sources stated on Sunday, citing a recent report by a global cybersecurity firm.In the report, Cyfirma identified the suspect as Lazarus, a group linked to North Korea’s Reconnaissance General Bureau, which oversees clandestine operations against the South, and said that the hackers exploited PHP2Shell vulnerabilities. They reportedly flagged South Korean internet protocol (IP) address ranges, including about 30 domestic servers and domains, as their targets in a private online channel. Cyfirma also assessed that the campaign was a targeted operation to steal financial resources and gather intelligence, rather than a series of random hacking attempts.
The cybersecurity company obtained chat records from the private channel, which reveal that the hackers scouted potential targets from IP ranges in South Korea, Japan, the United States, Thailand, Indonesia and India, likely deploying scanning nodes in the process. The hackers also reportedly prioritized PHP-based web servers used across seven key sectors — including government, financial services, ICT, critical infrastructure, logistics and aviation, manufacturing and online commerce — and discussed ways to breach them. Cyfirma obtained a list of 216 vulnerable servers across 10 countries and confirmed that 30 servers and domains were located in South Korea. The country also ranked among the hackers’ leading targets by number, after Japan and the United States.
A country-by-country breakdown of targets identified by North Korean hackers
CYFIRMA
The hackers appear to have accessed targeted systems via two remote code execution vulnerabilities in PHP core on Windows environments.Cyfirma found that the hackers sought to plant web shells — scripts designed to allow the user to remotely control a server — on systems by operating through 21 IP addresses that had previously been infected with scanning nodes. Investigators found that the hackers had expanded their operations to 581 hosts after obtaining administrator credentials and attempted to access additional systems within the hosts’ internal networks.The cybersecurity firm concealed the last section of each IP address associated with the 30 South Korean targets to reduce the risk of additional breaches.Rather than exploit weaknesses in individual web applications, the hackers targeted the PHP runtime itself, Cyfirma said. A successful breach would have allowed them to run arbitrary code on PHP-dependent applications and gain unauthorized access to servers.Cyfirma warned that updating web applications alone would not be enough to prevent future cyberattacks. It recommended patching PHP core itself and fully restarting web-related processes to reduce the risk of intrusion.BY JEONG JAE-HONG [lee.soojung1@joongang.co.kr]
This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.
Click Here For The Original Source.
——————————————————–
