While the Pegasus spyware is still lurking in the shadows, a new spyware has come crawling out of the woodwork. Dubbed Hermit, the spyware moves via SMS and impersonates applications from telecommunications companies or smartphone manufacturers. It can exploit a rooted device, record audio and make and redirect phone calls and collect data including call logs, contacts, photos, device location and SMS messages
The modular spyware is named after a distinct server path used by the attacker’s command and control (C2).
How did it all begin
The researchers from US-based Lookout Threat Lab, an integrated endpoint-to-cloud security company, first spotted the Hermit within Kazakhstan’s borders. The lab claims to have evidence that it was used by the government of Kazakhstan. “While we’ve been following this threat for a while using Lookout Endpoint Detection and Response (EDR) these latest samples were detected in April 2022, four months after nationwide protests against government policies were violently suppressed. Our analysis suggests that Hermit has not only been deployed to Kazakhstan but that an entity of the national government is likely behind the campaign,” said the Lookout team.