TOPIC
Campaign-specific DPRK-nexus targeting/scanning against PHP2Shell, scan/staging infrastructure provenance, successful-compromise boundaries and actor-attribution limits; separates generic multi-actor PHP2Shell exploitation from campaign identity.
1
6
3
4
3
NEW — CYFIRMA reports 216 filtered targets and 21 compromised scan nodes with low-and-slow rotation; AWS/Cloudflare/Sophos independently establish broad PHP2Shell exploitation pressure and one unrelated successful exploit; final Lazarus subcluster identity and campaign-specific compromise scale remain open.
THREAT_ACTOR_INFRASTRUCTURE_RESEARCH_TOPIC
—
—
—
A DPRK-nexus operator is actively staging and probing PHP2Shell targets; a specific Lazarus-ecosystem identity remains source-qualified rather than established equivalence.
Independent actor-linked infrastructure/tooling or authoritative attribution.
Low-volume scanning, infrastructure separation and node rotation favor temporal/behavior correlation over static IOC ownership.
Longitudinal provider/passive telemetry and replacement-node continuity.
The DPRK-nexus campaign has already achieved broad successful compromise across its filtered target set.
مرجع SSOT مسجل، لكن الرابط الداخلي مخفي حتى تفعيل حماية Admin.
Related Topics
Related Domains
الإجمالي: 6 Evidence
CYFIRMA reports a 216-host filtered target set and low-and-slow PHP2Shell weakness checks from 21 compromised nodes; scan infrastructure is separated from earlier staging and rotated deliberately.
لا يثبت: Does not prove mass successful compromise, named victims, or definitive Lazarus-subcluster identity; public v3 retains MODERATE confidence in Lazarus-ecosystem link.
فتح Run المصدرAWS MadPot observed PHP2Shell exploitation attempts from Oct 17 before public disclosure and broad follow-on attempts from anonymized infrastructure; multiple actors are likely.
لا يثبت: Does not attribute generic attempts to the CYFIRMA DPRK-nexus cluster and does not prove real-system success for those MadPot attempts.
فتح Run المصدرCloudflare observed PHP2Shell attack traffic against customers and payload mutation attempts against mitigations; protections were iteratively hardened through Oct 30.
لا يثبت: Does not identify the CYFIRMA actor or prove compromise behind every blocked request.
فتح Run المصدرPHP confirms CVE-2026-109618 and CVE-2026-109619 as critical unauthenticated RCE vulnerabilities and fixed branches; exploit reliability varies by build/deployment and updating is the complete mitigation.
لا يثبت: Does not establish a campaign, actor or victim; technical exploitability is deployment-dependent.
فتح Run المصدرNCSC-NL's operational tracker listed 929 products, including 217 vulnerable and 165 fixed as of Oct 30, demonstrating broad downstream product exposure beyond ordinary websites.
لا يثبت: Product exposure does not equal exploitation, compromise or actor targeting.
فتح Run المصدرSophos reported multiple PHP2Shell attempts and one successful exploitation in its telemetry with a Potassium/Mirai-like payload; no link to the CYFIRMA DPRK-nexus cluster was established.
لا يثبت: Does not corroborate Lazarus attribution and must not be merged with DPRK activity by shared vulnerability alone.
فتح Run المصدرCampaign-specific victim IR/provider telemetry and normalized denominator.
Generic PHP2Shell scanning, shared anonymization infrastructure or unrelated successful exploitation must not transfer DPRK/Lazarus attribution.
Case-linked payload/infrastructure lineage or independent attribution.
Public evidence supports DPRK-nexus activity but does not independently resolve a specific Lazarus subcluster or equivalence with TraderTraitor/Onyx Sleet/Pearl Sleet.
Independent actor-linked infrastructure/tooling, malware lineage or authoritative government/provider attribution.
No reliable campaign-specific denominator exists for successful compromise among the 216 reported filtered hosts; scanning/attempts are not compromise.
Victim IR, provider telemetry, verified shell/payload execution or incident disclosures linked to this campaign.
Ownership/control and current continuity of the 21 scan nodes and earlier staging infrastructure remain incomplete; compromised relays may rotate or be abandoned.
Passive DNS/provider logs, first/last-seen, replacement-node graph and campaign-linked traffic.
INFRASTRUCTURE_CONTINUITY