H0lyGh0st Ransomware · 2022-07
DEV-0530, a North Korea-origin ransomware cluster with suspected overlap with PLUTONIUM/Andariel tooling and infrastructure, used H0lyGh0st ransomware against small and midsize businesses from at least September 2021. The campaign encrypted Windows systems with SiennaPurple and SiennaBlue variants, used the .h0lyenc extension, demanded Bitcoin payments, and applied double-extortion pressure by threatening to publish or share victim data.
H0lyGh0st Ransomware attack · July
Annex 76: List of DPRK cyberthreat actors' malicious activities in 2022 monitored by the Panel. RGB Unit: Andariel; Case Name: H0lyGh0st Ransomware attack; VAS √; VAS Value: N/A; Publicized Month: July. (SPH Significant Phishing, KAC knowledge acquisition and espionage, VAS virtual asset seizures)
H0lyGh0st Ransomware · 2022-07
Reported: 2022-07; Victims: H0lyGh0st Ransomware; Motivations: FinancialGain; Sectors: None; Countries: United States
Small businesses in various countries · 14/07/2022
Researchers from Microsoft reveal that for more than a year, North Korean hackers have been running a ransomware operation called H0lyGh0st, attacking small businesses in various countries. [Date Occurred: Since more than a year; Date Discovered: -]
Holy Ghost (H0lyGh0st) ransomware linked by Microsoft to Andariel of Lazarus · 2022년 하반기
Holy Ghost 랜섬웨어를 추적한 결과, 이들은 주로 중소기업을 중심으로 은행, 학교, 제조업체 등에 암호화와 정보유출로 금전을 요구하는 이중갈취 협박을 해왔고, 북한의 사이버 범죄그룹 라자루스(Lazarus)의 위협행위자인 안다리엘(Andariel)과의 연결이 존재한다고 밝힘. 그림 1-1 개인정보 유출에 관한 Medibank 사과 성명, 2022년 10월 25일 그림 출처: SOCRadar, November 25, 2022 • 호주의 대형 건강보험회사 Medibank에서 랜섬웨어 공격으로 인한 피해가 발생함. 호주 인구의 1/3에 해당하는 약 970만 명에 달하는 고객의 과거 및 현재 건강정보가 유출됨. 집 주소, 전화번호, 의료보험번호 같은 개인정보뿐 아니라 48만 명의 의료서비스 기록 등 민감한 데이터가 모두 암호화되지 않은 채 유출됨. [KISA report, page 7]
“H0lyGh0st” ransomware extortion of small and medium-sized companies
Para 164: “A cybersecurity firm observed that a Democratic People’s Republic of Korea threat actor that calls itself the “H0lyGh0st” extorted ransoms from small- and medium-sized companies in several Member States by distributing ransomware in a widespread, financially motivated campaign. ... As part of their extortion tactics, they also threatened to publish victim data on social media or to send the data to the victims’ customers if the target refused to pay. The firm referred to “H0lyGh0st” as “DEV-0530” and assessed that “DEV-0530” appears to communicate and cooperate with Andariel.”
DEV-0530 / H0lyGh0st ransomware against small and midsize businesses · 2022-07-14T16:00:00+00:00 (published_time)
A group of actors originating from North Korea that Microsoft Threat Intelligence Center (MSTIC) tracks as DEV-0530 has been developing and using ransomware in attacks since June 2021. This group, which calls itself H0lyGh0st, utilizes a ransomware payload with the same name for its campaigns and has successfully compromised small businesses in multiple countries as early as September 2021. ... MSTIC assesses that DEV-0530 has connections with another North Korean-based group tracked as PLUTONIUM (aka DarkSeoul or Andariel).
DEV-0530 / H0lyGh0st ransomware (related to PLUTONIUM) · Microsoft Digital Defense Report 2022 (covers July 1, 2021 to June 30, 2022)
A group of actors originating from North Korea that Microsoft tracks as DEV-0530 began developing and using ransomware in attacks in June 2021. ... It is not certain that DEV-0530 activity was government-sponsored.
dollar figures: anywhere from 1.2 to 5 Bitcoins (asked of victims)
Based on our investigation, the attackers frequently asked victims for anywhere from 1.2 to 5 Bitcoins.