Hermit

Hermit is a malicious software (malware) linked to North Korea, also known as the "Hermit Kingdom" due to its isolationist policies. This malware, along with others like Pegasus and DevilsTongue, targeted Apple users leading to a wave of sophisticated attacks in July 2022. In response, Apple developed a new security feature called lockdown mode to protect against such cyberattacks. The Hermit malware has been associated with ScarCruft, a notorious North Korean state-sponsored threat actor known for targeting high-value individuals and organizations that align with North Korea's geopolitical objectives. The NSA's hacking operations against North Korea years prior to the Sony attack provided further evidence implicating North Korea in these cyber activities. Unit 42, a cybersecurity group, expressed moderate confidence that Contagious Interview, another cyber threat, was run by a North Korean state-sponsored actor, and high confidence that Wagemole was part of North Korea’s cyber campaigns. Furthermore, an unnamed US diplomat claimed that North Korea generates about half of its foreign-currency income from cyber-attacks on cryptocurrency and related targets. The Moonstone Sleet hackers, another group linked to North Korea, deployed a custom ransomware variant named "FakePenny," demanding higher extortion rates than previous examples. The Pyongyang threat group, associated with North Korea, has a history of using aggressive social engineering tactics against think tanks, governments, and journalists to gain intelligence on external perceptions of the Hermit Kingdom. After its launch in October 2022, Sinbad, a tool used to launder funds, was initially used in the $100m heist of Horizon and has since laundered tens of millions in stolen crypto-cash for North Korea. Reports indicate that North Korea’s state-sponsored hackers are among the world’s most relentless, stealing millions in cryptocurrency each year to fund the nation's nuclear programs. Lastly, ScarCruft targeted a trading company linked to Russia and North Korea using a novel phishing attack chain, signifying the Hermit Kingdom's ongoing attempts to target Russia.