Circumstances have been detected indicating that a large-scale cyberattack is being prepared by exploiting a critical security vulnerability in "PHP," a programming language widely used in websites worldwide.

The attacking entity has been pointed to as forces linked to the North Korean state-sponsored hacking group Lazarus.

However, direct links to the North Korean organization have not yet been confirmed, and some point out that a cautious judgment regarding the mastermind is necessary, separate from the attack preparation context.

Korean-Language Attack Planning; Government and Financial Institutions Top Targets

According to the security industry on the 24th, Singapore-based cybersecurity firm CYFIRMA detected a group of Korean-speaking operatives plotting a cyberattack using PHP vulnerabilities within "I2P," an anonymous, closed-loop network.

They were found to have discussed preliminary reconnaissance and concrete attack plans to target web servers worldwide using the recently discovered PHP vulnerabilities "PHP2Shell" (CVE-2026-109618, CVE-2026-109619).

PHP2Shell is a flaw that allows attackers to remotely execute commands on a server using crafted web requests without going through separate login or authentication procedures. It has been classified as "critical," scoring 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS).

CYFIRMA has named this attack preparation activity the "June 2026 Minjun" campaign, raising the possibility that the related group belongs to or is affiliated with the North Korean Lazarus Group ecosystem.

However, the analysis confidence for the North Korean link was evaluated at a "moderate" level.

According to the attack plans identified by CYFIRMA, they selected government agencies and financial institutions, including banks, as their primary targets. Manufacturing, logistics and shipping, airports and aviation, online trading platforms, trading companies, and construction companies were also included as attack targets.

By region, South Korea, the United States, Japan, Australia, Taiwan, India, Singapore, the United Arab Emirates (UAE), Saudi Arabia, and the European Union (EU) were cited as priority targets.

Circumstances of using Artificial Intelligence (AI) during the attack preparation process were also confirmed. CYFIRMA explained, "They are preparing attacks in a meticulous manner, such as collecting public proof-of-concept (PoC) exploit codes, prioritizing them with their own AI models, and verifying them in a controlled environment prior to actual use."

"Evidence of Direct Lazarus Link Needed"; Cautious Views on Mastermind Judgments

However, some analyses suggest that there is insufficient evidence to directly connect this attack preparation force to North Korea's Lazarus Group.

A security expert noted, "The evidence for the North Korean link presented by CYFIRMA amounts to attack instructions written in Korean, targeting primarily government and financial institutions, and attack tactics similar to the webshell methods previously used by Lazarus. However, overlapping evidence of malicious code or attack infrastructure directly connecting them to the Lazarus Group has not been confirmed."

"It is difficult to independently verify the actual involvement of North Korean hacking organizations based solely on public data," the expert added. "While the risk of the vulnerability itself and the signs of attack attempts should be prioritized for monitoring and response, it is appropriate to classify the involvement of North Korean organizations as information requiring additional verification."

Meanwhile, PHP is a server-side programming language used by a significant portion of websites worldwide. The PHP development team released an emergency security update on the 21st to patch these vulnerabilities.

The Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) issued a "Caution" alert regarding the PHP vulnerabilities on the 22nd, guiding enterprises on security response guidelines.

[Copyright (c) Global Economic Times. All Rights Reserved.]