Cybersecurity firm Cyfirma obtained chat logs from hackers' private communications tied with high confidence to the Lazarus Group, North Korea's state hacking network. The logs reveal a hit list of 216 web servers compiled on October 24, five days before the Binance security incident.
The United States topped the targeting list with 49 servers. Japan followed with 47 targets, India had 31, and South Korea had 30.
Targeting Strategy and Vulnerabilities
The hackers specifically hunted servers running PHP, the software behind approximately 69% of websites. They exploited two critical flaws in PHP, collectively dubbed PHP2Shell, which allowed unauthorized access to unpatched systems. PHP released security fixes on October 21, and five days later, the US cyber agency CISA listed both flaws as actively exploited in the wild.
Chat logs from the hackers indicated their focus on financial targets. One operator stated: "We need financial outcome and anything that leads to financial, trading or wallet material."
Confirmation of Breaches Unclear
While the hackers claimed that most of the 216 servers "already have something planted" and that the target list grew to 581 servers, Cyfirma verified neither assertion. The firm emphasized that appearance on the list indicates targeting, not compromise.
Cyfirma's advisory provided no confirmed victims and did not specify which sectors the 49 US servers belonged to.
Connection to Binance Incident Unconfirmed
Cyfirma's advisory made no mention of Binance. The FBI separately attributed the $6.3 billion Binance theft to North Korea, with US prosecutors moving to seize $1.2 billion of the stolen funds. Earlier, blockchain analysis firm Chainalysis attributed the $387 million Bitget theft to North Korean hackers as well.
Cyfirma recommended patching PHP and restarting all PHP processes, cautioning that updating websites alone would leave systems vulnerable to exploitation.
