The PolySwarm Blog

Verticals Targeted: Government, Financial, Manufacturing, Aviation, Airports
Regions Targeted: United States, Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia, European Union
Related Threat Actors: Lazarus Group

Executive Summary

A suspected North Korean state-linked threat operation has reportedly progressed from reconnaissance to active scanning of internet-facing PHP servers exposed to CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Operators communicating through a closed I2P channel reportedly identified 216 potentially vulnerable hosts and began conducting low-volume scans using 21 compromised systems, with government agencies and financial institutions among their priority targets. The activity raises concerns that attackers could exploit these critical vulnerabilities to establish persistent access, steal credentials, and conduct financial or intelligence-gathering operations against targeted organizations.