North Korea-Linked Lazarus Prepares Cyberattack Targeting South Korean Government, Financial Institutions, CYFIRMA Says

A North Korea-linked hacking group known as Lazarus is preparing a large-scale cyberattack targeting South Korean government agencies and financial institutions, cybersecurity firm CYFIRMA said. A successful breach could lead to digital-asset theft.

CYFIRMA said on its website on Oct. 24 that it detected signs on Oct. 22 that a Korean-speaking hacker was attempting to attack government agencies, financial institutions and other organizations worldwide by exploiting a security flaw in the PHP programming language. The company identified the North Korean hacking group Lazarus as being behind the activity.

Targets include government agencies, banks, manufacturers and online trading platforms in South Korea, the U.S., Japan, Singapore, Australia and the European Union.

The hackers are seeking to exploit a vulnerability known as PHP2Shell. The flaw allows malicious code to be executed on a web server without a separate login, potentially leading to data theft or deeper system intrusion.

CYFIRMA rated the threat level of the campaign as "very high." It also detected signs that artificial intelligence was used in the preparation process. The company said it had not confirmed a specific timing for the attack or the actual targets.

CYFIRMA warned that Lazarus could move to steal digital assets if it succeeds in breaching servers. The campaign could also lead to credential theft, ransomware attacks and the collection of confidential information.

To prevent damage, the company recommended applying relevant security patches and reviewing suspicious activity that occurred after Oct. 17.