Loading malware…
HolyGhost is Windows ransomware associated with North Korea-based operators conducting financially motivated double-extortion attacks. The operation primarily targets small and medium-sized enterprises, encrypting victim data and exfiltrating information to support ransom demands and threats of publication through a data-leak site. Its operators have communicated with and shared tooling associated with DarkSeoul, a threat group linked to Lazarus.
HolyGhost encrypts user files using AES and has been observed retrieving a public key from an HTTP command-and-control server. It creates a scheduled task that repeatedly executes the ransomware with SYSTEM privileges, providing persistent execution. Operators have used privileged or compromised accounts, Windows services, and scheduled tasks to deploy it across victim networks.
HolyGhost was also deployed in an April 2022 attack against an Argentinian government agency in which attackers exploited Log4Shell (CVE-2021-44228) in VMware Horizon for initial access. That intrusion included credential dumping, network scanning, and disabling Microsoft Defender real-time monitoring. These activities supported ransomware deployment but are not established as built-in capabilities of HolyGhost itself.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The attackers gained initial access by exploiting the vulnerability CVE-2021-44228 (Log4Shell) in VMware Horizon. | the attackers used a privileged account to run various files on the system and to run a malicious file known as HolyGhost Ransomware.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
HolyGhost is known to conduct double extortion, combining encryption of data with deliberate data exfiltration, and operates a data leak site.
The HolyGhost ransomware spread by the APT group known as Dark Seoul also created a task using schtasks.exe. | the attackers used a privileged account to run various files on the system and to run a malicious file known as HolyGhost Ransomware.
North Korean threat actors have previously been linked to other ransomware strains such as HolyGhost, PLAY, Maui, Qilin...
12 distinct techniques documented for this family, organized by ATT&CK tactic.
This complex type of startup is a technique known as Obfuscated Files or Information T1027.
While employing the Process Hollowing technique, an attacker is often disguised as a legitimate process (Masquerading T1036).
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware strain previously linked to North Korean threat actors (per the article).
Ransomware strain previously linked to North Korean threat actors.
Ransomware associated with the North Korean HolyGhost operation, which targets small and medium-sized enterprises for financial gain. The operation encrypts and exfiltrates data, typically demands 1.2–5 Bitcoins, and reportedly accepts substantial reductions during negotiations. The reference primarily discusses the operators rather than the malware's technical characteristics.
Go-based ransomware that encrypts user files, can disable shares, create/delete services, create scheduled tasks on remote machines, and retrieve a public encryption key from its C2 over HTTP.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.