North Korea's Lazarus Group Exploits PHP Zero-Day to Target Korean Banks and Global Government Systems

The Quick Take

• North Korea's Lazarus hacking group has been identified preparing large-scale cyberattacks exploiting PHP vulnerabilities targeting Korean government agencies, banks, and global financial infrastructure, according to threat intelligence from CYFIRMA
• A new PHP remote code execution zero-day (CVE-2026-115560) gives attackers arbitrary command execution access — Amazon's CISO confirmed exploitation attempts began four days before the vulnerability was publicly disclosed
• Korean financial institutions using PHP-based web portals face elevated breach risk; KISA issued emergency advisories while no formal security patch has yet been released, making mitigation measures the only available protection

North Korea's Lazarus hacking group has been identified preparing large-scale cyberattacks exploiting vulnerabilities in PHP — a programming language used by a substantial portion of the world's web infrastructure — with Korean government agencies, financial institutions, and banks among the primary targets. Threat intelligence from cybersecurity firm CYFIRMA identified a Korean-language operator using anonymous I2P network channels to plan global reconnaissance and attacks against web-accessible assets with PHP2Shell vulnerabilities. A new PHP remote code execution vulnerability (CVE-2026-115560) discovered by KISA allows attackers to execute arbitrary commands on affected servers when specific configuration conditions are met. Amazon's CISO separately confirmed that exploitation attempts began four days before the vulnerability was publicly disclosed, indicating active zero-day exploitation.

The financial sector exposure to this PHP vulnerability campaign is significant. Korean banks and many regional financial institutions operate PHP-based web portals for online banking, customer interfaces, and internal applications. CYFIRMA's intelligence indicates Lazarus-linked operators used anonymous I2P network channels to plan the attack campaign, identifying web-accessible assets with PHP2Shell vulnerabilities in what has been named the 'Minggun Campaign' — an escalation in North Korean cyber operations against financial infrastructure consistent with prior Lazarus campaigns targeting SWIFT systems and cryptocurrency exchanges. KISA has issued emergency mitigation guidance, but no formal security patch for CVE-2026-115560 has been released.

The cybersecurity investment implication is clear: financial institutions globally using PHP-based web infrastructure should treat this advisory as an urgent patching and mitigation priority. For cybersecurity sector investors, Lazarus group campaigns of this scale historically generate near-term demand spikes for threat intelligence services, emergency incident response contracts, and web application security platforms. Companies including CrowdStrike, Palo Alto Networks, and Korean cybersecurity specialists AhnLab and S2W that monitor nation-state threat actors stand to see elevated enterprise security spending following this advisory. The broader signal is that North Korean financial infrastructure attacks continue to intensify in technical sophistication, with zero-day capabilities now confirmed in this campaign.

Synthesized from 4 sources.