A Korean-Speaking Crew Is Building a PHP2Shell Hit List
CYFIRMA says Korean-speaking operators are quietly scanning 216 unpatched PHP hosts at governments, banks and logistics firms, with a moderate-confidence Lazarus link.
IOCs
Stories with indicators of compromise: attacker IPs, domains, URLs and file hashes to hunt for and block.
2 stories match your filters.
Lazarus Turns a Korean Banking Plug-In Into a Spy’s Front Door
Kaspersky says Lazarus abused South Korea's mandatory INISAFE CrossWeb EX security plug-in to break into at least three firms, using fake résumé sites, GitHub-based C2 and a post-quantum key exchange.