The Korea Herald reported Sunday that Cyfirma obtained an inventory compiled by Korean-speaking hackers, listing 30 South Korean servers among 216 possible targets; U.S. and Japanese servers made up 44.4%.
Cyfirma said the list was completed Oct. 24 and covered systems linked to public agencies and companies in banking, telecommunications and infrastructure. The firm’s regional breakdown counted 148 servers in Asia-Pacific, 49 in North America and 19 in the Middle East.
Cyfirma rated the hackers’ connection to the Lazarus Group ecosystem as high confidence. It said the activity appeared aimed at financial gain and espionage.
The firm cautioned that being named on the list did not establish that a server had been breached. Cyfirma urged administrators to install security patches and restart affected programs, warning that updating website applications alone would not address the vulnerabilities.
