Actor Profile

North Korean threat actors, attributed with moderate confidence to operators within the Lazarus Group ecosystem, are conducting a deliberate, low-and-slow scanning campaign targeting vulnerable PHP infrastructure globally. The activity is coordinated via a closed I2P channel by Korean-speaking operators (handles 전창혁 2 / Jeon Chang-hyuk 2 and 최아린 / Choi A-rin) previously observed in covert DPRK operations. Attribution is based on Korean language dialect (Munhwaŏ), C2 infrastructure overlap with Lazarus, and targeting priorities consistent with DPRK strategic objectives including financial theft and government espionage.

TTPs (Tactics, Techniques, Procedures)

The campaign leverages exploitation of PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) for initial access, though Unit 42 later clarified one incident involved a vulnerable PHP application rather than confirmed PHP2Shell CVE exploitation. Post-compromise TTPs include: credential harvesting (password hashes, MFA secrets), Active Directory reconnaissance via anonymous LDAP queries, NTLM relay tunneling, privilege escalation attempts targeting Domain Admin, and host enumeration. Attackers employ machine-parseable command delimiters (e.g., ==SHELLUSER==, ==PASSWD==) suggesting agentic AI-assisted operations. Infrastructure includes 21 compromised nodes conducting rotational, low-volume scanning to evade threshold-based detection. Historical Lazarus TTPs include PHP/WordPress server compromise for C2, web shell deployment (SyncHole campaign), and exploitation of web-facing assets.

Targets & Patterns

The campaign targets 216 unpatched or partially mitigated hosts across government, financial institutions, logistics, airports/aviation, manufacturing, and online transaction platforms. Geographic focus includes the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, U.A.E., Saudi Arabia, and the European Union. One confirmed incident involved a European government agency where attackers achieved credential theft and AD compromise within two hours. Target selection aligns with DPRK strategic priorities: government intelligence collection, financial institution compromise for revenue generation, and critical infrastructure reconnaissance. The low-and-slow scanning methodology with node rotation indicates deliberate target curation rather than opportunistic mass exploitation.

Historical Context

The activity is linked to the Lazarus Group ecosystem based on C2 infrastructure overlap with prior Lazarus operations and TTPs consistent with documented campaigns. Lazarus has a history of compromising PHP and WordPress servers for C2 infrastructure and deploying PHP/ASP web shells, as seen in the SyncHole watering hole campaign. The group's track record includes targeting financial institutions for cryptocurrency theft and government entities for espionage. The use of closed I2P channels for operational coordination and the involvement of known operator handles (Jeon Chang-hyuk 2, Choi A-rin) provide continuity with previous DPRK-linked covert operations. The PHP2Shell vulnerabilities have been subject to widespread scanning since public disclosure, with Cloudflare detecting millions of exploitation attempts.

Defensive Recommendations

  • Immediately patch CVE-2026-109618 and CVE-2026-109619 on all PHP infrastructure; prioritize internet-facing web applications and GlobalProtect instances
  • Monitor for PHP_SESSION_UPLOAD_PROGRESS markers (e.g., 'p2s-rider') and anomalous file upload requests with no payload in web server logs
  • Implement detection for machine-parseable command delimiters (==SHELLUSER==, ==PASSWD==, etc.) in command-line telemetry indicating agentic AI-assisted post-exploitation
  • Deploy behavioral analytics to detect low-and-slow scanning patterns with node rotation; supplement threshold-based alerting with anomaly detection for distributed, paced reconnaissance
  • Monitor for anonymous LDAP queries to domain controllers and NTLM relay activity; restrict LDAP anonymous binds and enforce SMB signing to prevent relay attacks
  • Block known mass-exploit infrastructure including 204.76.203[.]7 and investigate I2P traffic for potential C2 channels

---

# Geopolitical Context

Geopolitical Context

The suspected North Korean campaign exploiting PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) represents a continuation of DPRK cyber operations targeting critical infrastructure for intelligence collection and potential financial gain. The activity, attributed with moderate confidence to operators within the Lazarus Group ecosystem based on Korean-language indicators and infrastructure overlap, demonstrates sophisticated tradecraft including low-volume scanning from 21 compromised nodes to evade detection. The targeting of 216 hosts across government, financial, logistics, and aviation sectors in the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia, and the EU aligns with established DPRK operational priorities. Coordination via a closed I2P channel and use of previously observed Korean-speaking handles (Jeon Chang-hyuk 2, Choi A-rin) suggests operational continuity within North Korean cyber units. The incident involving a European government agency—initially misattributed to PHP2Shell exploitation but later clarified as targeting a vulnerable PHP application—illustrates the challenge of rapid attribution in complex intrusion scenarios. The observed use of agentic AI platforms for post-exploitation, including automated reconnaissance and privilege escalation attempts, may indicate evolving DPRK capabilities or contractor involvement.

State Actor Alignment

The campaign is attributed with moderate confidence to operators affiliated with the Lazarus Group, a threat cluster linked to North Korea's Reconnaissance General Bureau. Attribution is based on: (1) Korean-language communications using North Korean dialect (Munhwaŏ) in a closed I2P channel; (2) infrastructure overlap with previous Lazarus operations; (3) targeting priorities consistent with DPRK strategic objectives, particularly financial institutions and government agencies; and (4) tactical similarities to documented Lazarus campaigns including the SyncHole watering hole operation. The handles identified have been previously observed in covert DPRK cyber operations. North Korea remains under comprehensive international sanctions, including UN Security Council resolutions and unilateral measures by the U.S., EU, and regional partners, which prohibit cyber-enabled theft and sanctions evasion activities. The targeting of financial and transaction platforms is consistent with DPRK efforts to generate revenue amid sanctions pressure.

Business Impacty pro region

The campaign's geographic scope reflects North Korean cyber operations' global reach and prioritization of economically advanced democracies. European Union government agencies face persistent targeting, with the disclosed incident demonstrating rapid post-compromise progression (credential theft and privilege escalation within two hours). The concentration of targets in the Asia-Pacific—particularly U.S. treaty allies Japan, South Korea, Australia, and Thailand—suggests intelligence collection objectives tied to regional security dynamics and the Korean Peninsula situation. Financial sector targeting in Singapore, UAE, and Saudi Arabia aligns with DPRK revenue generation operations, potentially supporting weapons programs in violation of sanctions. The use of compromised infrastructure across multiple jurisdictions for scanning operations complicates attribution and response, requiring coordinated international action. For European defenders, the incident underscores the need for rapid patching of internet-facing applications and enhanced monitoring for post-exploitation indicators, particularly AI-assisted reconnaissance patterns. The low-and-slow scanning methodology employed—rotating nodes and abandoning infrastructure upon detection—challenges traditional threshold-based defenses and may require behavioral analytics and threat intelligence sharing across borders.

Forecast

If North Korean operators successfully exploit PHP2Shell vulnerabilities in prioritized targets, intrusions are likely to focus on financial theft from banking and transaction platforms, and intelligence collection from government and critical infrastructure entities. The operators' stated intention to "shortlist the most promising targets" and adapt public exploits suggests imminent exploitation attempts against the identified 216 hosts. Organizations in government, financial, logistics, and aviation sectors across the affected geographies should anticipate targeted intrusion attempts in the coming weeks. If the agentic AI capabilities observed in the European incident represent a broader operational shift, post-compromise timelines may compress further, reducing defender response windows. Continued international coordination on attribution, sanctions enforcement, and information sharing will be critical to disrupting DPRK cyber operations. If PHP2Shell patching rates remain low, the vulnerability may join the DPRK toolkit alongside previously exploited web application flaws. Defenders should prioritize patching PHP installations, monitoring for the specific behavioral indicators disclosed (machine-parseable command delimiters, LDAP reconnaissance patterns), and implementing network segmentation to limit lateral movement from compromised web-facing assets.