North Korea’s Lazarus Prepares Hack Attacks on South Korean Government, Financial Firms, CYFIRMA Says

A North Korean-linked hacking group known as Lazarus is preparing a large-scale cyberattack targeting South Korean government agencies and financial institutions, raising the risk of digital-asset theft if the operation succeeds.

On Oct. 24, global cybersecurity firm CYFIRMA said on its website that it had detected signs on Oct. 22 of a Korean-speaking hacker seeking to attack government agencies and financial institutions worldwide by exploiting a security vulnerability in the PHP programming language. It identified North Korean hacking group Lazarus as being behind the activity.

Potential targets include government agencies, banks, manufacturers and online trading platforms in South Korea, the US, Japan, Singapore, Australia and the European Union.

The hackers are aiming to exploit a security flaw known as PHP2Shell. The vulnerability can allow malicious code to run on a web server without a separate login, potentially leading to data theft or broader system intrusion.

CYFIRMA rated the threat level of the campaign as “very high.” It also said it had found signs that artificial intelligence was used during preparations for the attack. The company did not identify a specific timeline for the operation or confirm the actual targets.

CYFIRMA warned that if Lazarus succeeds in breaching servers, it may move to steal digital assets. The firm also said the attack could involve credential theft, ransomware and the collection of confidential information.

To prevent damage, CYFIRMA recommended applying relevant security patches and reviewing suspicious activity that occurred after Oct. 17.