North Korea hackers finished a hit list of 216 web servers on Oct. 24, five days before Binance lost $6.3 billion. The United States topped the list, with 49 targets.
Whether any of them were breached is still unknown. The hackers say yes. The firm that caught them says its evidence only proves targeting.
What Was on North Korea’s Hit List?
Cybersecurity firm Cyfirma obtained chat logs from the hackers’ private channel. It tied them with “high confidence” to the Lazarus Group, North Korea’s best-known state hacking network.
Japan followed the US with 47 servers. India had 31, and South Korea had 30, where the story broke on Sunday.
The crew hunted servers running PHP, the software behind about 69% of websites, according to W3Techs data cited by Tenable. Two critical flaws, nicknamed PHP2Shell, let outsiders take over unpatched machines.
PHP released fixes on Oct. 21. Five days later, the US cyber agency CISA listed both flaws as actively exploited.
The chats show what the hackers wanted.
“We need financial outcome and anything that leads to financial, trading or wallet material,” said Operator 1, in chats published by Cyfirma.
Were the US Servers Breached?
The hackers bragged that most of the 216 servers “already have something planted.” They also claimed the list grew to 581. Cyfirma verified neither claim.
“Appearance on the list indicates targeting, not compromise.”
The advisory names no confirmed victim. It also does not say which sectors the 49 US servers belong to.
Is the Hit List Linked to the Binance Hack?
Cyfirma’s advisory does not mention Binance. The FBI separately blamed North Korea for that theft, and US prosecutors are moving to seize $1.2 billion of it.
Earlier, Chainalysis pinned the $387 million Bitget theft on North Korean hackers too.
Cyfirma’s advice is short. Patch PHP itself, then restart every PHP process. Updating a website alone leaves the door open.
