As governments worldwide rush to address security flaws in PHP, the programming language used by approximately 70% of global websites, a global security firm headquartered in Singapore has raised the possibility of North Korean involvement. Cyfirma drew widespread attention with a report released on the 23rd, stating that after the PHP incident, a hacking group has been coordinating target lists and work instructions in Korean, primarily targeting government agencies and banks. The analysis noted similarities in attack tactics with the Lazarus Group, a North Korean hacker organization under the Reconnaissance General Bureau known for simultaneous information and financial theft from governments and corporations worldwide.
In an email interview with the JoongAng Ilbo on the 25th, Cyfirma founder Kumar Ritesh revealed additional hacking details, stating they detected signs that hackers suspected of having North Korean ties completed a list of 216 targets, including web servers in South Korea and the United States, earlier than planned on the night of the 24th. He added that reports indicated hackers had already accessed about a third of the targets to examine security vulnerabilities.
While noting that the North Korean connection has not been definitively confirmed, Ritesh disclosed clues used in their assessment, stating that the hackers used North Korean expressions such as calling the internet ‘internete’ and memory ‘giokgi’ (storage/memory unit). Below is the Q&A.
Q : How did you discover the hacking attempt by the group suspected of North Korean ties?
A : Since the middle of this year, we have tracked accounts named ‘Jeon Chang-hyuk 2’ and ‘Choi A-rin’ within ‘I2P’, an anonymous communication network. The communication between the two individuals on October 22-24, following the disclosure of the PHP vulnerability, was difficult to dismiss as casual chat. They selected PHP servers that lacked security updates or had only partial fixes, and gave specific instructions on which countries and industries to target first. On the night of the 24th, we even received reports that they had completed a list of 216 targets a day ahead of schedule.
Q : Does 216 refer to the number of agencies? Which countries and sectors are being targeted?
A : It does not mean the number of institutions. It means they selected 216 serversβcomputers running websitesβas attack targets. This number could increase as the hackers broaden their reconnaissance scope. Conversations indicated orders to target government agencies and banks first, followed by logistics, airports, airlines, manufacturing, and online trading platforms. South Korea, the United States, Japan, and the European Union are among the primary targets. This mirrors the target selection of Lazarus, which has pursued both information gathering and monetization. We have not secured the actual name list, so we do not know how many South Korean institutions are included.
Q : Are the attacks already underway?
A : The hackers are using computers they have taken control of to check for openings to infiltrate new targets. According to the October 24 chat, they inspected about a third of the targets within the first few hours. Sending too many connection requests at once can expose them, so they reduce the request volume and add intervals. They also change the computers used for connection and stop using them if blocking signs appear. It has not been confirmed whether they succeeded in infiltrating new targets.
Why North Korea is Suspected
Q : Why do you suspect a North Korean-linked group?
A : We have observed the same accounts carrying out operations similar to Lazarus in the past. In this recent conversation as well, while using Korean, they used North Korean expressions such as referring to the internet as ‘internete’, servers as ‘main computers’, and memory as ‘giokgi’. Lazarus-affiliated groups have historically hacked normal South Korean websites to spread malicious programs as stepping stones for subsequent attacks. This group is also using already-hacked servers to scout new targets and avoiding conspicuous mass connections. The fact that China and Russia, which have many vulnerable PHP servers, were omitted from the target list also resembles past North Korean target selection patterns.
Role of Artificial Intelligence in Cyberattacks
Q : Has artificial intelligence (AI) changed the hacking methods of this suspected North Korean group?
A : Their conversations mentioned using ‘local AI’ for reconnaissance and selecting attack code. This mainly involves running open-source AI models on their own computers. The AI prioritizes useful attack codes available on the internet, and they verify them. AI has shortened this process, significantly speeding up attack preparation.
Q : How should domestic institutions and companies respond?
A : The first thing to change is response time. AI has reduced the gap between vulnerability disclosure and exploitation from weeks to days, or sometimes even hours. There is no luxury to wait for scheduled monthly update dates. Servers that are externally accessible and targeted by attackers must be patched urgently.
