# Source: 北 연계 의심 해킹조직, PHP 취약점 공격 준비 정황…정부·금융 타깃 | 한국경제

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

한국경제: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# 北 연계 의심 해킹조직, PHP 취약점 공격 준비 정황…정부·금융 타깃 | 한국경제

**한국경제** · [https://www.hankyung.com/article/2026102423207](https://www.hankyung.com/article/2026102423207) · published 2026-10-24T11:02:46+09:00 · added by `curator@php.newsroom` · slug `hankyung-article-2026102423207`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Korea Economic Daily (Korean), 24 October: reconnaissance activity exploiting PHP2Shell spotted in a closed network. It reports that the Singapore thr...

## What it says, as the collector read it

#### 北 연계 의심 해킹조직, PHP 취약점 공격 준비 정황…정부·금융 타깃 | 한국경제

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/hankyung/article-2026102423207`, snapshot `20261024T133450Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T133450Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

Korea Economic Daily (Korean), 24 October: reconnaissance activity exploiting PHP2Shell spotted in a closed network. It reports that the Singapore threat-intelligence firm Cyfirma saw Korean-speaking members in a private channel on the anonymous I2P network planning attacks on web servers worldwide; a possible link to a North Korean hacking group is raised, but direct proof has not been obtained. This is the same Cyfirma report as the EBN piece in the vault, so the two Korean outlets are one source, not two.

> 폐쇄망서 'PHP2Shell' 악용 정찰 활동 포착

_Curator's translation:_ "Reconnaissance activity exploiting 'PHP2Shell' spotted in a closed network"

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "北 연계 의심 해킹조직, PHP 취약점 공격 준비 정황…정부·금융 타깃 | 한국경제". Selected mechanically, not read by a person.

#### Capture notes

Language `ko`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261024T133450Z · HTTP 200 · https://www.hankyung.com/article/2026102423207- `headers.json` 4f66c884c3592b6701c47dd1d8a9bdb30e409bca8fab57f9887915f899546052 471 bytes
- `page.html` e4bffbd69eead0a1a760d581a330a26e6bc1ff7f711725841ad5dd6da448ed43 99,338 bytes
- `provenance.json` bc1e3d4cdfc8562700fcac9e8f1ff65156ab4e2e574ffd1927b83ee8eabfc316 1,615 bytes
- `rendered.html` e7a1561f51a0a6709558a29b4fff05e6e58015b8a5426cbf5cb0af359dc51c2b 218,173 bytes
- `screenshot.jpg` bd1b4f549a4fdb7b177506b0ac650d0df994ef7f5b458d3366996d0f487e82ec 322,131 bytes
- `text.txt` 45e966bc2d1e536c2425f5330889db94abff79d1612b22589b95648277284a1c 7,407 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.0 · data as of 2026-10-25T09:35Z · vault commit 87795d121200 · https://php.oct.2026.newsroom.sgit.ai/sources/hankyung-article-2026102423207/index.html