Threat Actor 🇰🇵 North Korea
Storm-0530
Also known as: DEV-0530 · H0lyGh0st
H0lyGh0st is a North Korean threat actor that has been active since June 2021. They are responsible for developing and deploying the H0lyGh0st ransomware, which targets small-to-medium businesses in various sectors. The group employs "double extortion" tactics, encrypting data and threatening to publish it if the ransom is not paid. There are connections between H0lyGh0st and the PLUTONIUM APT group, indicating a possible affiliation.
Indicators of Compromise 3
MITRE ATT&CK TTPs 22
T1003 T1018 T1021.001 T1021.002 T1040 T1059 T1059.001 T1070.001 T1071.001 T1082 T1087 T1090 T1098 T1105 T1129 T1133 T1203 T1485 T1495 T1534 T1566 T1566.002
OS Credential Dumping
Credential Access
Remote System Discovery
Discovery
Remote Desktop Protocol
Lateral Movement
SMB/Windows Admin Shares
Lateral Movement
Network Sniffing
Credential Access
Command and Scripting Interpreter
Execution
PowerShell
Execution
Clear Windows Event Logs
Defense Evasion
Web Protocols
Command And Control
System Information Discovery
Discovery
Account Discovery
Discovery
Proxy
Command And Control
Account Manipulation
Persistence
Ingress Tool Transfer
Command And Control
Shared Modules
Execution
External Remote Services
Persistence
Exploitation for Client Execution
Execution
Data Destruction
Impact
Firmware Corruption
Impact
Internal Spearphishing
Lateral Movement
Phishing
Initial Access
Spearphishing Link
Initial Access