{"id":3768,"date":"2026-10-25T19:44:13","date_gmt":"2026-10-25T19:44:13","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3768"},"modified":"2026-10-25T19:44:13","modified_gmt":"2026-10-25T19:44:13","slug":"php2shell-exploitation-hits-government-entity-amid-global-scanning-and-signs-of-ai-assisted-hacking","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3768","title":{"rendered":"PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking"},"content":{"rendered":"
\n
<\/a><\/div>\n

Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619.<\/p>\n

\u00abIn one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed password hashes and multi-factor authentication secrets,\u00bb Palo Alto Networks Unit 42 said<\/a>.<\/p>\n

\u00abThey also established an NT LAN Manager (NTLM)-relay tunnel into Active Directory and attempted Domain Admin privilege escalation.\u00bb<\/p>\n

The network security company said it also observed the unknown attacker enumerating the compromised endpoint, with commands and behavioral markers suggesting the work of an agentic attacker. These include commands to facilitate –<\/p>\n

Reconnaissance of the authentication database with stolen credentials, targeting password hashes and two-factor authentication (2FA) secrets.<\/p>\n

Active Directory (AD) reconnaissance via curl-based anonymous LDAP queries to the domain controller (DC) in an attempt to look for the administrator account.<\/p>\n

\"\"<\/a><\/div>\n

Reconnaissance of the host to hunt for DNS\/AD integration, internal hosts, privileged groups, and interactive users.<\/p>\n

\u00abEach command batch is wrapped in section-header delimiters, such as ==SHELLUSER== and ==PASSWD==,\u00bb it added. \u00abThese delimiters produce machine-parseable output for an AI model to read.\u00bb<\/p>\n

Suspected N. Korea Campaign Targets PHP2Shell<\/h3>\n

The disclosure comes as CYFIRMA said it uncovered<\/a> a suspected North Korea-linked campaign employing PHP2Shell to actively probe global PHP infrastructure from 21 compromised nodes.<\/p>\n

\u00abThe scanning is deliberately low-volume and paced,\u00bb Kumar Ritesh, CEO and founder of CYFIRMA, told The Hacker News. \u00abNodes are rotated and abandoned at the first sign of blocking or rate-limiting, so threshold-based alerting is unlikely to catch it.\u00bb<\/p>\n

The targets comprise a set of 216 unpatched or partially mitigated hosts located across the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the U.A.E., Saudi Arabia, and the E.U. The hosts span government, financial institutions, logistics, airports and aviation, manufacturing, and online transaction platforms.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abThe campaign has moved from reconnaissance into active, low-and-slow scanning of a filtered target set,\u00bb CYFIRMA said. \u00abOrganizations in the prioritised sectors and geographies should assume they are in scope for deliberate targeting.\u00bb<\/p>\n

The activity, coordinated via a closed I2P channel, has been attributed with moderate confidence to a Korean-speaking operator assessed to be affiliated with the Lazarus Group ecosystem. According to CYFIRMA, the two handles (\uc804\ucc3d\ud601 2 aka Jeon Chang-hyuk 2) and (\ucd5c\uc544\ub9b0 aka Choi A-rin) active in the I2P channel have previously been observed running covert operations for the threat actors.<\/p>\n

\u00abKorean-speaking operators have used [the channel] to share target lists, exploit-hosting infrastructure, and tasking and prioritisation consistent with DPRK objectives,\u00bb Ritesh said. \u00abThe captured conversation uses vocabulary and spelling specific to North Korean (Munhwa\u014f) rather than the South Korean standard.\u00bb<\/p>\n

Other primary indicators that link the campaign to the Lazarus cluster are below –<\/p>\n