ctrlINT What the industry said about every indicator, with the quote

TEMP.HermitThreat actor

  • hermit neptune

Last reported 1 month ago, by Infosecurity Magazine2 reports

Suspected originNorth KoreaMISP Galaxy

ATT&CK techniques

2 techniques · each with the sentence it comes from
  1. T1657Financial Theft

    “Salaries were remitted to North Korea to help circumvent sanctions, while access obtained through employment could also support financial theft or espionage.”

    Infosecurity MagazineNews
  2. T1561Disk Wipe

    “…APT38, now considered as splitted between CryptoCore and Jade Sleet, which was a financially-motivated threat cluster, which leveraged disk-wipe techniques (KillDisk) as an anti-forensics measure in 2017.”

    Sekoia.ioVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

2 reports, newest first · the exact sentence from each

  1. “The research, published on September 7, categorized the former Lazarus umbrella into TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet and Famous Chollima.”

    Infosecurity MagazineNews
    North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters

  2. “We notably made our clustering evolved by splitting the Lazarus umbrella into six distinct sub-clusters: TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet, and Famous Chollima.”

    Sekoia.ioVendor
    Beyond Lazarus: How North Korea Organizes Its Cyber Operations

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with TEMP.Hermit here?
No account needed. We do not store your IP address.