ctrlINT What the industry said about every indicator, with the quote

Storm-0530Threat actor

  • dev-0530
  • H0lyGh0st

H0lyGh0st is a North Korean threat actor that has been active since June 2021. They are responsible for developing and deploying the H0lyGh0st ransomware, which targets small-to-medium businesses in various sectors. The group employs "double extortion" tactics, encrypting data and threatening to publish it if the ransom is not paid.From MISP Galaxy

Last reported 1 month ago, by Sekoia.io1 report

Suspected originNorth KoreaMISP Galaxy

ATT&CK techniques

2 techniques · each with the sentence it comes from
  1. T1561Disk Wipe

    “…APT38, now considered as splitted between CryptoCore and Jade Sleet, which was a financially-motivated threat cluster, which leveraged disk-wipe techniques (KillDisk) as an anti-forensics measure in 2017.”

    Sekoia.ioVendor
  2. T1657Financial Theft

    “Of note, Andariel is particular as it used custom ransomware (Maui and H0lyGh0st) for financial theft, as well as ransomware-as-a-service (RaaS) developed by an operator of the Russian cybercrime ecosystem.”

    Sekoia.ioVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

1 report, newest first · the exact sentence from each

  1. “Of note, Andariel is particular as it used custom ransomware (Maui and H0lyGh0st) for financial theft, as well as ransomware-as-a-service (RaaS) developed by an operator of the Russian cybercrime ecosystem.”

    Sekoia.ioVendor
    Beyond Lazarus: How North Korea Organizes Its Cyber Operations

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with Storm-0530 here?
No account needed. We do not store your IP address.