HolyGhost, also known as H0lyGh0st and tracked by Microsoft as DEV-0530 (later Storm-0530), is a North Korean ransomware group that first emerged in June 2021, evolving its malware from C++-based SiennaPurple variants to Go-based SiennaBlue variants by late 2021. The group is assessed with high confidence to be of North Korean origin, with suspected ties to state-backed groups like PLUTONIUM (also known as DarkSeoul or Andariel). HolyGhost's primary motivation is financial gain through extortion, often targeting small-to-midsize businesses globally, a strategy that distinguishes them from groups focusing solely on large enterprises. They are notable for their double extortion tactics, a willingness to negotiate ransom demands to significantly lower amounts, and their unusual practice of presenting themselves as ethical hackers offering security advice to victims, despite their mercenary intentions. The group has operated under several names, including its ransomware variants SiennaPurp

Aliases del actor

H0lyGh0stStorm-0530DEV-0530

Actores similares

Storm-0530apt · 0devmanransomware · 184stormousransomware · 177crimson-sandstormactor · 1Network Devicesactor · 1Compromise Software Dependencies and Development Toolsactor · 1Device Driver Discoveryactor · 1Storm-1811actor · 1Storm-0501apt · 1Dust Stormapt · 1

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker