1 min read

H0lyGh0st Ransomware: North Korea's New Weapon

Featured Image

Kim Jong-Un and his North Korean cronies have created a new cyber threat development group called H0lyGh0st (or DEV-0530). Their goal is to target and infect small-to-medium-sized businesses with nasty ransomware variants (also called H0lyGh0st) for financial gain.

Here's what you need to know:


The team at Microsoft's Threat Intelligence Center (MSTIC) first discovered H0lyGh0st towards the end of June 2021. Since then the ransomware group has been targeting organizations around the world and its reach has been growing.

How does H0lyGh0st work?

Just like most ransomware. Once they've tricked someone into installing it, or breached your system through other various means, the ransomware encrypts everything it finds with the file extension ".h0lyenc."

After encrypting the files, the group sends the victim a message demanding payment in Bitcoin, as well as a sample of their files as proof. They also send the victim a link to their ".onion" site where the victim can arrange payment via a contact form.

H0lyGh0st uses double extortion on their victims. First by demanding a payment to decrypt the victims' files and then again by threatening to release the files publicly if they don't receive payment.

Variants and More

According to the MSTIC there are two versions of H0lyGh0st's ransomware:

  • SiennaBlue (HolyRS.exe, HolyLocker.exe, and BTLC.exe)
  • SiennaPurple (BTLC_C.exe)

SiennaBlue is written in the open-source Go programing language. SiennaPurple is written in C++. The SiennaPurple variant isn't as robust as its counterpart. SiennaBlue has a variety of features ranging from multiple encryption options, string obfuscation, public key management, and support for internet and intranet.

How to Protect Yourself

Microsoft recommends you buy all of their BRAND new MSSP products because...of course they do.  However, other next-generation antivirus products (like Blackberry Protect and Cybereason) offer similar protection.

Beyond that the basic defensive positions apply: 

  • Proper firewall policies
  • Security awareness training for end-users
  • Regular back-ups


That's about all we've got for you right now. If there's any new information released we'll publish it here on the blog.  Otherwise, you can read more about H0lyGh0st here on Microsoft's site.

Dark Utilities: Off the shelf Command-And-Control Attacks...

Entities offering Cyberattacks-as-a-Service are fairly common and the newest member of the club, called Dark Utilities, is gaining popularity quickly.

Read More

What is a Managed Cybersecurity Services Provider?

We talk a lot about being a Managed Cybersecurity Services Provider and I thought it'd be a good idea to dive into exactly what a Managed...

Read More

Check Out or New Social Engineering Attack Guide!

We've been warning people for YEARS regarding the dangers posed by Social Engineering Attacks. We decided it was time to collect all of that...

Read More