Hackers used Korean to coordinate potential PHP attack targeting banks, government, logistics

A cybersecurity firm says attackers resembling North Korea's Lazarus group are preparing to exploit a global PHP vulnerability against critical infrastructure targets worldwide.

Hackers communicating in Korean appear to be preparing cyberattacks on government agencies and financial institutions worldwide by exploiting a security flaw in PHP, a programming language widely used to run websites, according to a cybersecurity report.

The attackers’ tactics resemble those of Lazarus, a North Korean hacking group, the report said. However, no evidence directly linking the activity to North Korea has yet been confirmed.

Singapore-based cybersecurity firm Cyfirma said in a report released Friday that it had detected Korean-speaking attackers preparing to exploit the PHP vulnerability through private communication channels on I2P, an anonymous network, according to the security industry on Saturday.

Cyfirma named the activity the “June 2026 Minjun” campaign.

PHP is a programming language widely used for server-side tasks such as website logins, post management and data processing. The newly discovered flaw is not an error on a specific website but a security defect in PHP itself.

The vulnerability is considered highly dangerous because attackers can exploit it without logging in to execute commands on a server or steal internal information. The security industry refers to the flaw as “PHP2Shell.”

According to Cyfirma, the attackers researched ways to exploit the flaw and discussed collecting publicly available proof-of-concept exploit code from the internet to test whether it actually works.

Gov'ts scramble to patch websites after AI uncovers hidden PHP flaws

Gov'ts scramble to patch websites after AI uncovers hidden PHP flaws

Cybersecurity agency calls for immediate PHP updates over critical security flaws

Cybersecurity agency calls for immediate PHP updates over critical security flaws

Yonsei University cyberattack exposes personal data of 10,000 students, graduates

Yonsei University cyberattack exposes personal data of 10,000 students, graduates

There were also signs that the attackers used AI in their preparations, such as using AI models to prioritize which code to review.

Government agencies, banks and financial institutions in several countries, including Korea, the United States, Japan and Australia, were listed as priority targets. Manufacturing, logistics and shipping, airports and aviation, online trading platforms, trading companies and construction firms were also mentioned as potential targets.

Cyfirma said the use of Korean, the method of selecting targets and the established web attack tactics resembled the activity patterns of Lazarus, a hacking group believed to be backed by North Korea.

While the firm highly assessed its confidence in the attack preparations, it rated the likelihood of a link to Lazarus as “moderate.”

Some in the security industry say it is difficult to conclude that North Korea is behind the activity.

The use of Korean or the targeting of government and financial institutions alone is not enough to prove the involvement of a North Korean group, they say, adding that no malware or attack infrastructure directly tied to Lazarus has been identified. It has also not been confirmed whether any large-scale breach has actually occurred.

“It is appropriate to prioritize monitoring and responding to the risk posed by the vulnerability itself and the signs of attack preparation, while classifying North Korean involvement as information requiring further verification,” said one security expert.

Meanwhile, the PHP development team released an update fixing the vulnerability on Wednesday. The Ministry of Science and ICT and the Korea Internet & Security Agency issued a “caution” alert over the vulnerability on Thursday and provided security guidance to companies.

BY KO SEUNG-PYO [[email protected]]

This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.