How many South Korean servers did Cyfirma identify as potential targets, and what kinds of organizations did the list cover?

Thirty of the 216 servers on the list were located in South Korea. The targets included servers belonging to government agencies, banks, telecommunications companies and infrastructure providers.

When was the list of servers targeted by hackers suspected of links to Lazarus completed?

The original list of 216 servers across 10 countries was completed on Oct. 24. The report said the servers had been compiled by Korean-speaking hackers.

N. Korea-linked hackers target 30 S. Korean servers: report

Q: What cybersecurity steps did Cyfirma recommend for administrators of potentially vulnerable servers?

Cyfirma urged administrators to install security patches and restart affected programs. It warned that simply updating website applications would not address the vulnerabilities, and said inclusion on the list did not necessarily mean a server had been breached.

Listen

Summary

Cyfirma identified 30 servers in South Korea among 216 servers across 10 countries listed as potential cyberattack targets by Korean-speaking hackers, with the list completed on Oct. 24. The firm assessed with high confidence that the hackers were linked to the Lazarus Group ecosystem and said their apparent objectives included financial gain and espionage. Cyfirma cautioned that being on the list did not mean a server had been breached and urged administrators to install security patches and restart affected programs.

Key Facts

The list covered government agencies, banks, telecommunications companies and infrastructure providers.
The Asia-Pacific accounted for 148 listed servers, North America for 49 and the Middle East for 19.
The United States and Japan together accounted for 44.4 percent of the listed servers.
Cyfirma said updating website applications alone would not address the vulnerabilities.

By Yonhap

Published Nov 15, 2026 10:29 am KST
Updated Nov 15, 2026 10:30 am KST

Hackers suspected of having ties to North Korea's Lazarus Group identified 30 servers in South Korea as potential targets for cyberattacks in October, a report released by a cybersecurity firm showed Sunday.

Cyfirma said it obtained a list of 216 servers across 10 countries compiled by Korean-speaking hackers, covering government agencies, banks, telecommunications companies and infrastructure providers.

Of the total, 30 servers were located in South Korea. The original 216-server list was completed on Oct. 24, the report showed.

By region, the Asia-Pacific accounted for 148 targeted servers, followed by North America with 49 and the Middle East with 19.

The United States and Japan together accounted for 44.4 percent of the total, Cyfirma added.

The cybersecurity firm assessed with "high confidence" that the hackers were linked to the Lazarus Group ecosystem, with their apparent objectives including financial gain and espionage.

Cyfirma stressed that inclusion on the target list did not necessarily mean the servers had been successfully breached.

The company warned that simply updating website applications would not address the vulnerabilities, urging administrators to install security patches and restart the affected programs.

Explore More