A threat cluster suspected of links to North Korea’s Lazarus ecosystem has been observed discussing preparations to attack government and financial institutions, including targets in South Korea, according to reports citing Singapore cybersecurity company CYFIRMA. The activity, tracked as the “June 2026 Minjun” campaign, was identified in Korean-language conversations on the anonymity network I2P. The available evidence indicates planning and testing rather than confirmation that the proposed attacks have occurred.
- Campaign name
- June 2026 Minjun
- Reported vulnerabilities
- CVE-2026-109618 and CVE-2026-109619
- Severity rating
- CVSS 9.2
- Priority targets
- Government and financial institutions, including organizations in South Korea
CYFIRMA said the participants examined two critical PHP web server vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively described as “PHP2Shell.” Crafted web requests could reportedly exploit the flaws to execute commands remotely without a valid login. The vulnerabilities received a CVSS severity score of 9.2, placing internet-facing PHP systems at particular risk if security updates have not been applied.
Targets extended across critical industries
The reported preparations extended beyond government agencies and banks. Potential targets included manufacturers, shipping and logistics companies, airlines, airport facilities, e-commerce operators, trading companies and construction businesses across multiple countries. The participants reportedly obtained publicly available demonstration code, used an internal artificial intelligence model to help select targets and tested whether the technique worked in a separate environment.
CYFIRMA assessed a possible North Korean connection with medium confidence, citing the use of Korean, the emphasis on government and financial targets and similarities to web-shell tactics previously associated with Lazarus. That assessment remains unconfirmed. A security expert quoted in the reporting noted that investigators had not identified direct overlap in malware or attack infrastructure linking the activity conclusively to Lazarus.
The PHP development team has issued emergency fixes for the reported flaws. South Korea’s Ministry of Science and ICT and the Korea Internet & Security Agency have also released a vulnerability alert and security guidance. Organizations operating PHP servers should identify exposed systems, apply the relevant updates and monitor for suspicious requests or command execution. Further technical evidence, including shared infrastructure or malware, will be needed before the campaign’s attribution can be strengthened.