Follow-up to Oct 25: CYFIRMA tracks a separate suspected DPRK PHP2Shell campaign
Its October 24 advisory describes 216 target hosts and 21 scanning nodes, with moderate confidence in the North Korean attribution.
ThereforeDefenders can use its campaign-specific addresses to hunt for prior contact in their logs.