{
  "family": "hermes",
  "sample_count": 7,
  "category": "ransomware",
  "description": "Ransom:Win32/Hermes is a targeted, destructive ransomware strain first observed in early 2017 across Russian cybercrime underground forums. In October 2017, Hermes rose to global prominence when it was deployed by the North Korean state-sponsored threat group Lazarus Group (specifically APT38 / Hidden Cobra) during the high-profile cyber heist against Taiwan's Far Eastern International Bank (FEIB). In that intrusion, Lazarus leveraged Hermes as a diversionary wiper-ransomware payload to paralyze incident responders, obscure forensic artifact trails, and destroy local system logs while operators executed fraudulent SWIFT interbank transactions totaling $60 million. Hermes is historically significant as the direct technological predecessor and codebase progenitor for Ryuk ransomware, which emerged in mid-2018 when the Wizard Spider cybercrime syndicate adapted Hermes' source code for targeted enterprise big-game hunting. Hermes employs RSA-2048 public key encryption paired with per-file AES-256-CBC symmetric keys, terminates critical database and backup services via batch script command loops (HERMES.bat), and securely destroys Shadow Copies through vssadmin and bcdedit system manipulation.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Hermes",
    "Hermes 2.1",
    "Ransom.Hermes",
    "Trojan-Ransom.Win32.Hermes"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Hermes ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Hermes is a targeted ransomware family first detected in 2017, known for its deployment in state-sponsored bank heists and for serving as the foundational codebase for Ryuk ransomware."
      }
    },
    {
      "@type": "Question",
      "name": "How was Hermes used in the Far Eastern International Bank (FEIB) heist?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Lazarus Group (APT38) deployed Hermes on FEIB network servers to destroy event logs and distract security analysts while the group executed $60 million in fraudulent SWIFT financial transfers."
      }
    },
    {
      "@type": "Question",
      "name": "What is the relationship between Hermes and Ryuk?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Ryuk ransomware was directly created from the Hermes 2.1 source code, retaining identical cryptographic file structures, encryption markers, and batch script execution commands."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptographic algorithms are used by Hermes?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Hermes uses AES-256-CBC to encrypt file contents and RSA-2048 to encrypt the AES symmetric session keys, appending the 'HERMES' file marker."
      }
    },
    {
      "@type": "Question",
      "name": "What vulnerabilities were used to distribute Hermes?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Hermes payloads were delivered via spear-phishing emails containing malicious Microsoft Office attachments exploiting CVE-2017-0199 and CVE-2017-11882."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1070.001",
    "T1490",
    "T1059.003",
    "T1566.001",
    "T1027"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "impact"
    },
    {
      "id": "T1070.001",
      "name": "Clear Windows Event Logs",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "impact"
    },
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactic": "execution"
    },
    {
      "id": "T1566.001",
      "name": "Spearphishing Attachment",
      "tactic": "initial-access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "defense-evasion"
    }
  ],
  "cisa_advisory": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-280a",
  "last_updated": "2026-10-14",
  "first_seen": 2017,
  "lineage": {
    "derived_from": [],
    "variants": [
      "hermes 2.1 (taiwan feib heist)",
      "ryuk (direct successor)",
      "conti (lineage)"
    ]
  },
  "attribution": [
    {
      "actor": "Lazarus Group (APT38 / Hidden Cobra)",
      "confidence": "high"
    },
    {
      "actor": "Russian Cybercrime Underground",
      "confidence": "medium"
    }
  ],
  "exploited_cves": [
    "CVE-2017-0199",
    "CVE-2017-11882"
  ],
  "c2_profile": {
    "protocols": [
      "HTTPS",
      "HTTP"
    ],
    "ports": [
      443,
      80
    ],
    "traffic_identifiability": "medium"
  },
  "iocs": {
    "file_hashes": [
      "a83233ff28b5e7d58fa66f44d56f5a34f9a46087b22ab1a0f8eb898eb2ec8fb2",
      "4619d803c004245cc87ffec5a0ee3303d7ac5c8ba17fe94f576e273a5a407f2b"
    ],
    "delivery": [
      "spearphishing_attachment",
      "compromised_network_shares"
    ],
    "persistence": [
      "HERMES.bat execution",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
    ]
  },
  "sources": [
    {
      "name": "CISA Cybersecurity Advisory AA20-280A: FASTCash 2.0 & Lazarus Group",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-280a"
    },
    {
      "name": "BAE Systems Threat Research: Taiwan Bank Heist and Hermes Ransomware",
      "url": "https://www.baesystems.com/en/cybersecurity/threat-intelligence"
    },
    {
      "name": "US Department of Justice Indictment of Park Jin Hyok (Lazarus Group)",
      "url": "https://www.justice.gov/opa/pr/north-korean-regime-backed-programmer-charged-conspiracy-conduct-multiple-cyberattacks"
    }
  ],
  "containment_steps": [
    "Segregate SWIFT messaging terminals and financial transaction hosts onto isolated, air-gapped VLANs.",
    "Deploy endpoint detection agents to identify and block batch script execution invoking vssadmin delete shadows.",
    "Inspect perimeter firewalls for anomalous outbound connections to known Lazarus Group command infrastructure.",
    "Enforce security updates for Microsoft Office equation editor vulnerabilities CVE-2017-0199 and CVE-2017-11882."
  ],
  "what_to_avoid": [
    "Do not allow direct internet access from financial processing or SWIFT financial network environments.",
    "Avoid running endpoint backups on mapped, write-accessible network shares accessible to ransomware operators.",
    "Never enable Office macro execution on inbound emails from external domains."
  ],
  "target_industries": [
    "banking",
    "financial_services",
    "fintech",
    "critical_infrastructure"
  ],
  "motivation": "Financial Extortion & Distraction Sabotage",
  "threat_actors": [
    "Lazarus Group (APT38)",
    "Hermes Operators"
  ],
  "target_geographies": [
    "TW",
    "US",
    "KR",
    "JP",
    "VN"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "defense-evasion",
    "impact"
  ],
  "ecosystem": [
    "windows",
    "x86",
    "x64"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}