MediumII Cyber Warfare & Critical Infrastructure24 October 2026, Saturday
Suspected North Korea-linked group readies PHP exploit against banks
Singapore-based cybersecurity firm CYFIRMA said on 24 October that a Korean-speaking group is preparing attacks on government and financial institutions using PHP2Shell flaws. It holds the attack plan with high confidence and the Lazarus link with moderate confidence; the target list was expected to be finalised on 25 October.
According to Aju Press, CYFIRMA found that the operators discussed targets and preparations on a closed, anonymous network on 22 October. The group has built an online infrastructure of 15 components, but no specific attack date has been set. On 23 October the firm saw 17 IP addresses testing similar techniques, though it has not proved they belong to the same group. The operators collect publicly available attack methods, rank them with an AI model and then test them in a controlled environment.
Electronic Times reports that CYFIRMA named the campaign 'June 2026 Minjun' and identified the I2P anonymity network as the channel. The flaws are CVE-2026-109618 and CVE-2026-109619, each scored 9.2 out of 10 for severity, and they allow unauthenticated command execution on servers. PHP released patches on 21 October. The target list covers South Korea, the US, Japan, Australia, Taiwan, India, Singapore, the UAE and Saudi Arabia, with government agencies and banks first in line.
The Lazarus attribution rests on 3 elements: Korean-language instructions, government and financial targets, and a web-shell method resembling past operations. CYFIRMA said it found no direct match with known Lazarus malware or infrastructure. The Ministry of Science and ICT and KISA raised the private-sector cyber crisis alert from 'Caution' to 'Alert' on 22 October. CYFIRMA has advised organisations to look for signs of intrusion dating back to 17 October.
Talay assessment
Bottom line
The warning shows PHP2Shell entering the window where mass scanning gives way to targeted operations; the group is picking targets before any broad sweep. Because attribution remains at moderate confidence, the real signal is not the Lazarus name. It is that unpatched government and bank servers in 9 countries now sit on the same list. The most likely path is a trickle of individual breaches over weeks, not a mass outage.
Likely effects
- Asian financial infrastructureNegativeWeeks
Banks are priority targets; a new wave on top of the bank breaches running in Korea since September adds to supervisory and disclosure burdens.
- Public servicesNegativeWeeks
Advice to isolate or shut down servers that cannot be patched could extend precautionary outages on government websites.
- Cyber attribution policyUncertain1–6 months
Moderate-confidence attribution keeps Seoul cautious about formally accusing Pyongyang; no diplomatic step is expected without evidence.
Possibilities, ranked
- 1Targeted but limited breaches55%
The campaign starts and web shells turn up at a few unpatched institutions, but there is no systemic financial outage.
Watch: First official breach notice linked to PHP2Shell from KISA or Japan
- 2Campaign postponed30%
Rapid patch uptake and delays in reliable exploit code push the group back; the alert level is lowered.
Watch: Korea lowering its private-sector alert to 'Caution'
- 3Major financial breach15%
A large data leak is confirmed at a bank or government agency and attribution becomes official.
Watch: A new breach statement from Korea's Financial Services Commission or the police
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Flaw severity score▼ 9.2/10
- Infrastructure built▼ 15 components
- Suspicious IP addresses▼ 17