temp.hermit

Temp.Hermit, also known as Selective Pisces or Diamond Sleet, is a cyber threat actor linked to North Korea. This group has been active since 2013 and targets governments, defense, telecommunications, and financial services sectors with cyberespionage operations. Temp.Hermit's activities often overlap with other North Korean-aligned hacking groups like Lazarus Group (also known as APT38) and Labyrinth Chollima. In addition to these, several other threat groups are aligned with North Korea's Reconnaissance General Bureau (RGB), including Kimsuky (tracked as APT43 by Mandiant) and Andariel, which is often linked to ransomware activities. In October 2023, the Lazarus Group, also referred to as Temp.Hermit or Hidden Cobra, continued its Operation Dream Job campaign, targeting defense industry and nuclear engineers with trojanized Virtual Network Computing apps. The group's activities—tracked as UNC2970 or Temp.Hermit by Mandiant and included under the broader Lazarus umbrella by others—utilize specially crafted LinkedIn accounts based on legitimate users. These accounts are professionally curated to mimic the identities of legitimate users to build rapport and increase the likelihood of conversation and interaction. Despite the widespread overlap of tooling and tactics across North Korean-aligned hacking groups, Mandiant considers Temp.Hermit to be a distinct subset of activity under the control of North Korea's Reconnaissance General Bureau, focused on intelligence collection. This indicates the size and priorities of this actor, which publicly aligns with the DPRK's Reconnaissance General Bureau. With the constant evolution of their tactics and the use of sophisticated methods, Temp.Hermit continues to pose a significant cybersecurity threat.