The Android app was discovered by researchers at Lookout Threat Lab. With this, attackers can gain access to both built-in smartphone apps like the address book and camera, as well as downloaded apps like WhatsApp and Telegram. According to experts, Hermit victims have included business leaders, human rights defenders, journalists, scientists and government officials..

what is known

Hermit, which can be called a virus, spreads via fake SMS, which seems to come from an official source – operator, brand, bank. There is a link in the text message after the app is downloaded.

• According to Lookout, the Hermit program was most likely developed by the Italian company RCS Lab, which is officially engaged in telecommunications solutions, and its structure Tykelab Srl. In 2012, he was the vendor of HackingTeam, another Italian spyware vendor now known as Memento Labs.
• Correspondence between the two companies revealed that RCS Lab is collaborating with the military and intelligence services of Pakistan, Chile, Mongolia, Bangladesh, Vietnam, Myanmar and Turkmenistan.
• Cybersecurity researchers also said they knew about the iOS version of Hermit, but “couldn’t get a sample for analysis.”

A sophisticated Lookout analysis shows that: The Hermit was not only deployed in Kazakhstan, but also served behind the government’s campaign.. It was first noticed in April 2022 and the operators were dubbed “oppo.service” in the guise of Chinese electronics manufacturer Oppo. Also found are examples pretending to be Samsung and Vivo.

The Hermit was not only available in Kazakhstan: previously the software appears to have been deployed by Italian authorities during an “anti-corruption operation” and then in a Kurdish-speaking region in northeastern Syria.