Verticals Targeted: Cryptocurrency
Verticals Targeted: Government, Financial, Manufacturing, Aviation, Airports
Regions Targeted: United States, Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia, European Union
Related Threat Actors: Lazarus Group
Executive Summary
A suspected North Korean state-linked threat operation has reportedly progressed from reconnaissance to active scanning of internet-facing PHP servers exposed to CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Operators communicating through a closed I2P channel reportedly identified 216 potentially vulnerable hosts and began conducting low-volume scans using 21 compromised systems, with government agencies and financial institutions among their priority targets. The activity raises concerns that attackers could exploit these critical vulnerabilities to establish persistent access, steal credentials, and conduct financial or intelligence-gathering operations against targeted organizations.
Verticals Targeted: Financial, Cryptocurrency
Related Threat Actors: Lazarus
Related Families: DPAPILoader, RemotePELoader, RemotePE
Executive Summary
Researchers identified a sophisticated Lazarus-linked malware ecosystem composed of DPAPILoader, RemotePELoader, and RemotePE, a chained toolset designed for stealth, persistence, and long-term access in high-value financial and cryptocurrency environments. The malware leverages DPAPI-based environmental keying, direct syscall techniques, ETW suppression, and memory-only payload execution to minimize forensic visibility and evade modern endpoint defenses.
