Storm-0530
Storm-0530 is a North Korea-linked threat actor associated with the H0lyGh0st ransomware (a self-chosen name used on the group’s ransom page). Microsoft reporting describes Storm-0530 as having notable affiliations with the North Korean actor Onyx Sleet (aka Silent Chollima/Andariel): Storm-0530 has been observed interacting with Onyx Sleet email accounts and communicating with known Onyx Sleet attacker accounts, and Microsoft states the two operate from the same infrastructure set and use custom malware controllers with similar names. H0lyGh0st ransomware campaigns attributed to Storm-0530 compromised small businesses in multiple countries as early as September 2021, including very small organizations (e.g., small schools and a family-owned plumbing business). Analysis of H0lyGh0st-associated cryptocurrency wallets reportedly showed the operators received zero Bitcoin payments.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Associated malware families
2 malware families attributed to this actor across reporting.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.