North Korean hackers targets businesses with H0lyGh0st ransomware

A group of North Korean hackers called H0lyGh0st are targeting small and medium-sized enterprises with ransomware attacks.

Microsoft Threat Intelligence Center classify the group as DEV-0530, a term for unknown emerging, or an evolving group of threat activities.

DEV-0530 demand ransoms between 1,2 and 5 Bitcoins. DEV-0530 is believed to have links to several other ransomware groups, including Plutonium alias DarkSeoul or Andariel, a North Korean-based sub-group operating under the Lazarus umbrella (aka Zinc or Hidden Cobra).

While it began targeting small businesses since September 2021, four different variants of the H0lyGh0st ransomware were churned out between June 2021 and May 2022 to target Windows systems. These include BTLC_C exe, HolyRS.exe, HolyLock.exe, and BLTC.

BTLC _C.exe dubbed SiennaPurple is written in C++, while the other three versions (codenamed SiennaBlue are programmed in Go, indicating an attempt to develop cross-platform malware.

“Along with their H0lyGh0st payload, DEV-0530 maintains an .onion site that the group uses to interact with their victims. The group’s standard methodology is to encrypt all files on the target device and use the file extension .h0lyenc, send the victim a sample of the files as proof, and then demand payment in Bitcoin in exchange for restoring access to the files,” the researchers said.

The sources for this piece include an article in TheHackerNews.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web