North Korean Hackers Completed a 216-Server List on Oct. 24, 49 Targets in the US

A 216-Server List Closed on Oct. 24

Hackers tied to North Korea completed a target list of 216 web servers on Oct. 24, five days before Binance lost $6.3 billion, and the United States led the list with 49 targets. Cyfirma, a cybersecurity firm that obtained the group's private chat logs, attributed the campaign with “high confidence” to the Lazarus Group, North Korea's best-known state hacking network. The logs came from a private channel the operators used to coordinate, and they pin down the day the list was finished without recording when the work began, a gap the advisory leaves open. Japan follows the United States with 47 servers, India holds 31 and South Korea 30; the South Korean detail surfaced in local reporting on Sunday. The four named countries account for 157 of the 216 servers, and the American count of 49 is the largest single-country share in the record. The crew hunted machines running PHP, the server-side language behind about 69% of all websites, according to W3Techs figures cited by Tenable, which is why one flaw family scales across so much of the web at once. Every entry is a web server rather than an end-user device, so the staging work aimed at infrastructure, not at individuals' laptops or phones. Two critical defects, nicknamed PHP2Shell, allowed an outsider to take control of any unpatched server running affected versions. The five-day distance between the list's completion and the Binance loss is what drew outside attention, although the advisory itself draws no line between the staging campaign and the exchange theft.

PHP2Shell and a Five-Day Patch Clock

The flaw pair sat at the center of the operation, and the name describes the path from a defect in PHP processing to a full remote takeover of the host. PHP's maintainers shipped fixes for both vulnerabilities on Oct. 21. Five days later, CISA, the US Cybersecurity and Infrastructure Security Agency, placed both defects on its list of issues being actively exploited in the wild, the catalog federal agencies treat as an urgent patching priority. For anyone running PHP in production, that five-day stretch became the effective deadline. Operators who patched late, or who restarted applications without rebuilding the PHP runtime, left the exposure in place. The chat logs spell out the objective behind the staging. One operator, identified as Operator 1, wrote: “We need financial outcome and anything that leads to financial, trading or wallet material.” In the advisory's framing, that demand covers anything that could lead the crew toward funds: exchange credentials, trading access, crypto futures accounts or stored wallet data. Nothing in the logs limits the scope to one region or one platform. The operators also talked up their results, claiming most of the 216 servers “already have something planted” and that the list had since grown to 581 targets. Cyfirma verified neither statement. Its verdict on the list itself is clipped: “Appearance on the list indicates targeting, not compromise.” The advisory names no confirmed victim, and it does not say which sectors the 49 US servers belong to. That silence is deliberate: the firm's evidence base is the chat channel itself, not server forensics. Remediation, as the Cyfirma threat advisory sets it out, takes two steps: patch PHP itself, then restart every PHP process. Updating a website alone, the firm warns, leaves the door open.

The Binance Question

Cyfirma's advisory does not mention Binance by name. The FBI has separately blamed North Korea for the exchange theft, and US prosecutors are moving to seize $1.2 billion of the proceeds. Chainalysis, in earlier research, pinned a $387 million theft from Bitget on North Korean hackers as well. The list and the Binance loss sit five days apart, but no published evidence turns that timing into cause; the confirmed North Korea-linked losses around exchanges already run to roughly $1.6 billion across the seizure case and Bitget, before anything from the 216-server campaign is counted. The distinction matters for holders: a breached web server does not by itself reach coins in self-custody, whether a hardware signer or a product such as Tangem Pay, while custodial balances rest on exchange infrastructure that crews tied to the same network have historically hit, from cross-chain bridges to exchange systems. As of Sunday, Cyfirma's advisory is the last documented word: targeting confirmed, compromise unproven.