CYFIRMA observed a Korean-speaking team preparing the June 2026 Minjun campaign to exploit CVE-2026-109618 and CVE-2026-109619 across internet-facing PHP systems, prioritising government, finance, manufacturing, logistics and aviation targets. The operators reportedly used a closed I2P channel to coordinate infrastructure, rank public proof-of-concept code with a local AI model and prepare a country-and-sector target list while avoiding noisy scanning. CYFIRMA links the activity to the Lazarus ecosystem with moderate confidence, citing language, targeting and historical web-shell tradecraft but acknowledging the absence of definitive malware or infrastructure overlap. The advisory provides staging infrastructure, suspected exploitation sources, payload indicators and urgent patching and hunting guidance.