Loading malware…
H0lyGh0st is a North Korea-linked ransomware family and associated extortion operation active since 2021, commonly tracked as DEV-0530 and assessed to have ties to the Lazarus ecosystem, particularly overlaps with Andariel/Onyx Sleet. It has been used primarily against small and midsize organizations, including entities in financial services, manufacturing, education, entertainment, and healthcare, and has also appeared in broader DPRK ransomware activity targeting critical infrastructure.
The malware supports a double-extortion model in which operators steal victim data before encrypting systems and then threaten public disclosure to pressure payment. Reported variants include an early C++ lineage and later Go-based builds. Observed behavior includes encryption of victim files, ransom-note deployment, and use of victim communication infrastructure associated with extortion operations. Some variants have been described as encoding filenames during encryption and using customized note and locker implementations across versions.
Initial access has been associated with exploitation of vulnerable public-facing applications, including known web application vulnerabilities, and DPRK ransomware operations using H0lyGh0st have also been linked more broadly to phishing and other intrusion methods. Reporting has described post-compromise activity consistent with enterprise ransomware operations, including lateral movement, data exfiltration, and persistence mechanisms such as scheduled-task creation in at least one variant.
H0lyGh0st is notable in strategic context because it reflects DPRK operators’ use of ransomware for revenue generation alongside espionage activity. Multiple assessments connect the operation to North Korean state-sponsored actors or affiliated clusters, and Microsoft has reported overlaps between H0lyGh0st activity and Andariel/Onyx Sleet tradecraft and infrastructure. The family is frequently discussed alongside other DPRK-associated ransomware such as Maui and, historically, WannaCry.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Recently observed CVEs that actors used to gain access include ... remote code execution in unpatched SonicWall SMA 100 appliances... Observed CVEs used include: CVE-2021-20038
Recently observed CVEs that actors used to gain access include remote code execution in the Apache Log4j software library (known as Log4Shell)... Observed CVEs used include: CVE-2021-44228
Observed CVEs used include: ... CVE-2022-24990 ... The TerraMaster OS Unauthenticated Remote Command Execution via PHP Object Instantiation Vulnerability is characterized by scanning activity targeting a flaw...
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Andariel itself has a track record of deploying custom ransomware families like SHATTEREDGLASS, Maui, and H0lyGh0st in the past.
Lazarus Group has historically deployed its own ransomware families -- Maui, H0lyGh0st, and WannaCry.
the cybercriminal group which developed the H0lyGh0st ransomware is assessed to be originating from the DPRK
Microsoft reported on Onyx Sleet’s and Storm-0530’s h0lyGhost ransomware in 2022.
8 distinct techniques documented for this family, organized by ATT&CK tactic.
"...remote code execution in unpatched SonicWall SMA 100 appliances [T1190 and T1133]."
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware family previously deployed by Andariel, mentioned as background context.
Referenced as a prior Lazarus-operated ransomware family historically built and controlled by the group.
H0lyGh0st is cited as a ransomware family historically deployed by Lazarus Group.
A bespoke ransomware family used by the Lazarus sub-cluster Andariel in attacks against entities in South Korea, Japan, and the U.S.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.