Security Firm Cyfirma Reports Suspected North Korean Hackers Scanning Global PHP Hosts for PHP2Shell Exploitation, Prioritizing Taiwan
Cyfirma reports that suspected North Korean Lazarus-linked hackers began scanning global unpatched hosts for the PHP2Shell vulnerability shortly after its disclosure, with Taiwan listed as a priority target.
Security firm Cyfirma warned that immediately after the PHP development team announced and patched the major PHP2Shell vulnerability on October 21, suspected North Korean hacker groups linked to Lazarus began reconnaissance and scanning of global web hosts vulnerable to PHP2Shell, filtering for targets that had not yet completed patching.
Cyfirma discovered two Korean-speaking hackers coordinating attack activities and sharing infrastructure. They built a list of 216 hosts suspected of being unpatched or only partially mitigated, executing low-frequency, batched vulnerability scans through 21 compromised nodes to avoid detection by minimizing dense connections. By October 24, hackers had scanned approximately one-third of the targets, attempting to deploy PHP-based Webshells and contaminate data.
The targeted countries and regions include Taiwan, the United States, Japan, Thailand, Indonesia, South Korea, Australia, India, Singapore, Saudi Arabia, and the European Union. The targeted industries span government agencies, banks and financial institutions, manufacturing, logistics, shipping, airports and aviation, and online trading platforms.