PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity

{"

AI-Driven Exploitation Activity Against PHP2Shell Vulnerabilities":"Palo Alto Networks Unit 42 observed AI-driven post-exploitation activity targeting a European government agency. The attackers used stolen credentials and NTLM-relay tunnels to access sensitive information. CYFIRMA detected a suspected North Korea-linked campaign using PHP2Shell for global scanning. The activity is coordinated via a closed I2P channel, with targets spanning various sectors and geographies. The Lazarus Group is suspected to be behind the campaign, given its history of exploiting PHP and WordPress servers for C2 and planting web shells. The activity is moving from reconnaissance to active scanning, with operators planning to shortlist promising targets and adapt public exploits.","

North Korea-Linked PHP2Shell Campaign":"CYFIRMA identified a suspected North Korea-linked campaign using PHP2Shell for global scanning. The campaign targets 216 unpatched or partially mitigated hosts across various sectors and geographies. The activity is coordinated via a closed I2P channel, with operators using covert operations and sharing target lists. The Lazarus Group is suspected to be behind the campaign, given its history of exploiting PHP and WordPress servers for C2 and planting web shells. The activity is moving from reconnaissance to active scanning, with operators planning to shortlist promising targets and adapt public exploits.","

Exploit Efforts and Mitigations":"Defused Cyber observed PHP2Shell probes targeting Palo Alto Networks GlobalProtect honeypots. The activity originates from a known mass-exploit IP address. The probes are likely an attempt to identify vulnerable devices. Palo Alto Networks and CYFIRMA highlight the need for organizations to patch and monitor for such attacks, given the widespread scanning efforts and the risk of remote code execution in default PHP configurations."}