Holyghost
Ransomware Group Profile
Overview
HolyGhost (tracked by Microsoft as DEV-0530) is a North Korean state-linked ransomware group active since June 2021, associated with the Andariel threat group, targeting small to mid-sized businesses in financial services, manufacturing, education, and entertainment globally.
Dark Web Infrastructure (1)
matmq3z3hiovia3voe2tix2x54sghc3tszj74xgdy4tqtypoycszqzqd.onion
Activity Timeline
First Seen2024
Last Seen2024
Leak Sites1
Quick Actions