Hackers mention “Korea’s IP Promising” in the chat room 사진 확대 North Korea hacking. [Yonhap News] It was found that the North Korean-linked hacking organization “Lazarus” attempted cyberattacks targeting major industries such as South Korea’s government, finance, and telecommunications. After hackers directly mentioned Korea’s Internet Address (IP) band as promising targets for attacks, 30 domestic servers and domains were identified on the actual target list.According to Yonhap News on the 15th, Cyperma, a global threat intelligence company, revealed the situation of cyberattacks against South Korea by Lazarus, a North Korean-linked hacking organization, in an update report on the “PHP2Shell Vulnerability Abuse Status” released earlier this month.According to the report, hackers discussed the target countries on the 28th of last month on the closed online channel of the dark web and mentioned, “Some IP bands in Korea, Japan, the United States, Thailand, Indonesia, and India look quite promising.” It was analyzed that the government did not just randomly find targets for attacks, but tried to infiltrate by selecting servers from major industries in each country.The targets of the attack are government agencies, banks and financial institutions, telecommunications, core infrastructure, logistics and aviation, manufacturing, and online trading platforms. Hackers targeted PHP-based web servers used in these industries first.The actual size of the attack was also found to be significant. As a result of analyzing the original target list of 216 exposed servers in 10 countries secured by Cyperma, a total of 30 domestic servers and domains were counted. It is in the top ranks in the Asia-Pacific region after Japan and the United States.The attack used a remote penetration method that exploited PHP vulnerabilities. The attackers were found to have targeted CVE-2026-109618 and CVE-2026-109619, which are remote code execution (RCE) vulnerabilities of PHP cores running on Windows operating systems.According to Cyperma, the attackers tried to distribute a webshell (malicious script) to the target server using the IPs of 21 scan nodes that were previously infected. Since then, the target of the attack has been expanded to a total of 581 hosts by attempting horizontal movement to steal manager account information and expand the scope of penetration into the internal network.To prevent further damage, Cyperma disclosed the IP addresses of 30 domestic targets partially covered in its report.The security industry is paying attention to the fact that the vulnerability used in this attack exists in the PHP runtime itself. It is explained that it is difficult to respond simply by updating the website application.”We cannot defend ourselves just by updating our website applications,” Cyperma said in a report. “System administrators must apply security patches to the PHP core itself and then completely restart all web worker processes to block the penetration of the web shell.”
Click Here For The Original Source.
——————————————————–
