CYFIRMA: Korean-speaking operatives plotting large-scale attacks on PHP2Shell flaw, Lazarus link 'moderate'
Singapore-based cybersecurity firm CYFIRMA says it has detected Korean-speaking operatives on the anonymous I2P network plotting large-scale cyberattacks on the critical PHP2Shell web-server flaws — a campaign it calls 'June 2026 Minjun' with a 'moderate'-confidence link to North Korea's Lazarus Group. Government agencies and banks are the top-listed targets; no breaches are confirmed.
Singapore-based cybersecurity firm CYFIRMA has detected Korean-speaking operatives discussing plans to exploit the critical PHP2Shell web-server vulnerabilities as part of a large-scale attack campaign, with government agencies and financial institutions at the top of the target list.
The operatives were observed on Thursday on I2P, an anonymous closed network, discussing reconnaissance and detailed attack plans to strike web servers worldwide using the two PHP2Shell flaws — CVE-2026-109618 and CVE-2026-109619 — SBS reported, citing Yonhap News. The flaws let attackers run commands on a server through a crafted web request without logging in, and carry a CVSS severity score of 9.2 out of 10, rated critical.
CYFIRMA has named the activity the “June 2026 Minjun” campaign and says the group may belong to or be linked to the North Korean Lazarus Group ecosystem — but rates that attribution at only “moderate” confidence, urging caution.
According to the intercepted plans, top-priority targets are government agencies and financial institutions including banks, followed by manufacturing, logistics and shipping, airports and aviation, online trading platforms, trading companies and construction firms. The target regions named are South Korea, the United States, Japan, Australia, Taiwan, India, Singapore, the United Arab Emirates, Saudi Arabia and the European Union.
The firm also says the attackers are using artificial intelligence in their preparations — collecting public proof-of-concept exploit code, prioritising it with their own AI model and validating it in controlled environments.
CYFIRMA stresses that no successful breaches of South Korean companies or public institutions have been confirmed, and there is no confirmed start date or concrete target list. South Korea’s Ministry of Science and ICT and the Korea Internet and Security Agency issued a “caution” alert for the vulnerability on Thursday after PHP’s developers released emergency fixes.
Sources: SBS News (https://news.sbs.co.kr/english/article.do?news_id=N1008812986); Maeil Business Newspaper (https://www.mk.co.kr/en/world/12184766); Aju Press (https://www.ajupress.com//view/20261024120625247); JKN (https://news.jkn.co.kr/editions/english/post/1045783).
More on this topic: all Technology stories
