Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025
Watering hole attacks via ROK authentication software and infiltration of IT asset management servers · 2023 and 2024
(MSMT/2025/2, report p. 91) “In 2023 and 2024, Temp.Hermit distributed malware by exploiting vulnerabilities in various authentication software solutions widely adopted in the ROK. Temp.Hermit employed “watering hole” tactics to launch the cyber operation, hacking into Korean news websites to embed malicious code ... Notably, in order to breach ROK cyber infrastructure, Temp.Hermit infiltrated IT asset management servers to identify vulnerabilities of IT assets in Korean networks. This cyber operation is assessed to be pre-positioning by the DPRK for future destructive and disruptive cyber operations”