MalwareUsed by 2 actors

VHD ransomware

VHD ransomware is a ransomware family first observed in 2020 and attributed with high confidence to North Korean operators, specifically activity associated with Lazarus-linked financial intrusion clusters such as APT38. It has been reported as distributed through the MATA framework and has been observed in incidents alongside known Lazarus tooling, including campaigns targeting businesses in France and Asia and broader activity focused on the APAC region.

The malware is notable for targeted rather than indiscriminate deployment. Reporting has characterized VHD and closely related families as part of narrowly scoped revenue-generation operations rather than conventional large-scale criminal ransomware campaigns. Observed ransom demands and payments were comparatively small, and the activity has been assessed as aligned with DPRK state-backed financial objectives. In at least one broader DPRK-linked intrusion context, ransomware was reportedly used as a distraction during financially motivated operations.

VHD ransomware has also drawn attention for its self-replication behavior. Code and artifact analysis has linked it to several other small ransomware families, including BEAF, PXJ, ZZZZ, and CHiCHi, with especially strong similarity between BEAF and ZZZZ. These overlaps, together with operational context and delivery through MATA, support assessment that VHD belongs to a cluster of related DPRK-associated ransomware tooling.

The family is associated with Lazarus Group operations and fits within North Korea’s broader pattern of combining espionage, disruptive activity, and revenue-generating cyber operations. Its known use against business targets and its linkage to financially motivated DPRK campaigns make it significant less as a mass-extortion threat than as a specialized ransomware capability embedded in state-directed intrusion activity.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Lazarus

In May, researchers at cybersecurity firm Trellix tied the recently emerged VHD ransomware to the North Korean APT.

via threatpostthreatpost.com

APT38

in March 2020, a new malware family surfaced called ‘VHD ransomware’... Many in the industry attributed the VHD ransomware to DPRK hackers. It was distributed using the MATA framework

via trellix othertrellix.com

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

It contained a list of administrative credentials and IP addresses specific to the victim, and leveraged them to brute-force the SMB service on every discovered machine.

T1190Exploit Public-Facing ApplicationEvidence1

In this instance, we believe initial access was achieved through opportunistic exploitation of a vulnerable VPN gateway.

Execution

2 techniques

T1047Windows Management InstrumentationEvidence1

Whenever a successful connection was made, a network share was mounted, and the VHD ransomware was copied and executed through WMI calls.

T1204User ExecutionEvidence1

In this instance, there was no spreading utility, but the ransomware was staged through a downloader written in Python that we still believe to be in development.

Persistence

1 technique

T1078Valid AccountsEvidence1

It contained a list of administrative credentials and IP addresses specific to the victim, and leveraged them to brute-force the SMB service on every discovered machine.

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

It contained a list of administrative credentials and IP addresses specific to the victim, and leveraged them to brute-force the SMB service on every discovered machine.

Stealth

1 technique

T1078Valid AccountsEvidence1

It contained a list of administrative credentials and IP addresses specific to the victim, and leveraged them to brute-force the SMB service on every discovered machine.

Credential Access

1 technique

T1110Brute ForceEvidence1

It contained a list of administrative credentials and IP addresses specific to the victim, and leveraged them to brute-force the SMB service on every discovered machine.

Lateral Movement

2 techniques

T1021Remote ServicesEvidence1

Whenever a successful connection was made, a network share was mounted, and the VHD ransomware was copied and executed through WMI calls.

T1021.002SMB/Windows Admin SharesEvidence1

Whenever a successful connection was made, a network share was mounted, and the VHD ransomware was copied and executed through WMI calls.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Whenever a successful connection was made, a network share was mounted, and the VHD ransomware was copied and executed through WMI calls.

Impact

3 techniques

T1486Data Encrypted for ImpactEvidence4

The ransomware itself is nothing special: it’s written in C++ and crawls all connected disks to encrypt files... Files are encrypted with a combination of AES-256 in ECB mode and RSA-2048.

T1489Service StopEvidence1

The program also stops processes that could be locking important files, such as Microsoft Exchange and SQL Server.

T1490Inhibit System RecoveryEvidence1

The ransomware itself is nothing special: it’s written in C++ and crawls all connected disks to encrypt files and delete any folder called “System Volume Information” (which are linked to Windows’ restore point feature).

INDICATORS OF COMPROMISE

IOCs tracked for this family

9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app5 years ago

ip.v4●●●●●●●●●●●●View more in app5 years ago

domain●●●●●●●●●●●●View more in app5 years ago

hash.md5●●●●●●●●●●●●View more in app5 years ago

ip.v4●●●●●●●●●●●●View more in app5 years ago

hash.md5●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

trellix otherNews

May 19, 2026

The Hermit Kingdom’s Ransomware Play

A ransomware family first seen in March 2020 and attributed in the article to DPRK-linked operators. It was reportedly distributed via the MATA framework and used in targeted attacks, particularly in the APAC region, with relatively small ransom payments observed.

threatpostNews

Aug 17, 2022

APT Lazarus Targets Engineers with macOS Malware | Threatpost

A recently emerged ransomware family that the article mentions as being tied to Lazarus in separate reporting.

securelistNews

Jul 29, 2020

APT trends report Q2 2020

VHD is a ransomware family notable for its self-replication and use in targeted attacks, attributed to the Lazarus group.

i blackhat archiveNews

Aug 14, 2026

Named ransomware referenced in the context of DPRK expanded criminal operations targeting cryptocurrency-related entities.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching9

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

VHD ransomware