A group of North Korean hackers called H0lyGh0st are targeting small and medium-sized enterprises with ransomware attacks.
Microsoft Threat Intelligence Center classify the group as DEV-0530, a term for unknown emerging, or an evolving group of threat activities.
DEV-0530 demand ransoms between 1,2 and 5 Bitcoins. DEV-0530 is believed to have links to several other ransomware groups, including Plutonium alias DarkSeoul or Andariel, a North Korean-based sub-group operating under the Lazarus umbrella (aka Zinc or Hidden Cobra).
While it began targeting small businesses since September 2021, four different variants of the H0lyGh0st ransomware were churned out between June 2021 and May 2022 to target Windows systems. These include BTLC_C exe, HolyRS.exe, HolyLock.exe, and BLTC.
BTLC _C.exe dubbed SiennaPurple is written in C++, while the other three versions (codenamed SiennaBlue are programmed in Go, indicating an attempt to develop cross-platform malware.
“Along with their H0lyGh0st payload, DEV-0530 maintains an .onion site that the group uses to interact with their victims. The group’s standard methodology is to encrypt all files on the target device and use the file extension .h0lyenc, send the victim a sample of the files as proof, and then demand payment in Bitcoin in exchange for restoring access to the files,” the researchers said.
The sources for this piece include an article in TheHackerNews.