Key facts
- Cyfirma said it obtained a 216-server target list compiled by Korean-speaking hackers across 10 countries.
- Cyfirma said 30 of the listed servers were in South Korea, covering government agencies, banks and telecoms.
- Cyfirma assessed with high confidence that the hackers were linked to the Lazarus Group ecosystem.
- Cyfirma said the hackers' apparent objectives included financial gain and espionage.
Cybersecurity firm Cyfirma said hackers suspected of ties to North Korea's Lazarus Group identified 30 servers in South Korea as potential targets for cyberattacks in October, according to a report released on Sunday, November 15, 2026, and carried by Yonhap.
Cyfirma said it obtained a list of 216 servers across 10 countries compiled by Korean-speaking hackers, covering government agencies, banks, telecommunications companies and infrastructure providers. The original 216-server list was completed on October 24, the report showed.
By region, the Asia-Pacific accounted for 148 targeted servers, followed by North America with 49 and the Middle East with 19. The United States and Japan together accounted for 44.4 percent of the total, Cyfirma added.
The firm assessed with high confidence that the hackers were linked to the Lazarus Group ecosystem, with their apparent objectives including financial gain and espionage. Cyfirma stressed that inclusion on the target list did not necessarily mean the servers had been successfully breached.
Cyfirma warned that simply updating website applications would not address the vulnerabilities, urging administrators to install security patches and restart the affected programs.