Loading malware…
H0lyGh0st is a Windows ransomware family used by a North Korea-based extortion group tracked by Microsoft as Storm-0530, formerly DEV-0530. Active since at least June 2021, the operation has compromised small and midsize organizations across multiple countries, including manufacturing, financial services, education, and entertainment businesses. Its double-extortion workflow combines data theft with file encryption and demands for bitcoin payments, backed by threats to publish stolen information. The operators have documented infrastructure, communications, and tooling overlaps with Andariel, also known as Onyx Sleet, without the two groups necessarily being identical.
Early H0lyGh0st payloads, classified as SiennaPurple, were written in C++; later SiennaBlue variants were developed in Go and share encryption, key-management, and networking functionality. The ransomware encodes filenames with Base64, marks encrypted files, and creates a ransom note. Some variants use string obfuscation, while later variants support scheduled-task persistence and fallback communication through internal network resources. The operators exploit vulnerable public-facing applications to obtain access before deploying ransomware. H0lyGh0st is among the privately developed ransomware families associated with DPRK-linked financially motivated cyber operations.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Andariel est notable pour l’utilisation des ransomwares personnalisés Maui et H0lyGh0st, ainsi que du RaaS Play en 2024.
Lazarus Group has historically deployed its own ransomware families -- Maui, H0lyGh0st, and WannaCry.
the cybercriminal group which developed the H0lyGh0st ransomware is assessed to be originating from the DPRK
Microsoft reported on Onyx Sleet’s and Storm-0530’s h0lyGhost ransomware in 2022.
8 distinct techniques documented for this family, organized by ATT&CK tactic.
"Acquire Infrastructure [ T1583 ] . DPRK actors generate domains, personas, and accounts; and identify cryptocurrency services to conduct their ransomware operations."
"Purchase VPNs and VPSs [ T1583.003 ] . DPRK cyber actors will also use virtual private networks (VPNs) and virtual private servers (VPSs) or third-country IP addresses..."
"...remote code execution in unpatched SonicWall SMA 100 appliances [T1190 and T1133]."
These threat actors are known to obfuscate their identities by operating under third-party foreign affiliate identities, purchase VPNs or foreign IP addresses, and use known vulnerabilities to gain network access.
"Actors also likely spread malicious code through Trojanized files for “X-Popup,” an open source messenger... [T1195]."
"...remote code execution in unpatched SonicWall SMA 100 appliances [T1190 and T1133]."
"...perform reconnaissance activities, upload and download additional files and executables, and execute shell commands [T1083, T1021]."
"...perform reconnaissance activities... and execute shell commands [T1083, T1021]."
Actors have used privately developed ransomware, such as Maui and H0lyGh0st [T1486]. Actors have also been observed using or possessing publically available tools for encryption.
27 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.