holyghost
- First seen
- 2021-06-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Last IoC activity
- 2026-05-08 12:58:27
- Profile updated
- 2026-07-07 13:53:34
Targeted industries: education-and-nonprofits financial-services manufacturing professional-services
Targeted regions: country_code:us country_code:kr country_code:br country_code:in
Context
HolyGhost is a ransomware group first publicly reported in July 2022, believed to be operated by a North Korean state-sponsored threat actor tracked as APT43 or Andariel, a subgroup of the Lazarus Group. The group has been active since at least June 2021, using a double-extortion model that combines encryption of victim files with threats to leak stolen data via a Tor site. Early HolyGhost variants (BTLC_C.exe) used a custom file extension .h0lyenc, while later builds added more robust encryption, obfuscation, and evasion capabilities. Targeted victims include small and medium-sized businesses in manufacturing, finance, education, and event planning, primarily in the United States, South Korea, Brazil, and India. Intrusion methods include exploitation of vulnerable public-facing applications, credential theft, and possibly the use of purchased access from other threat actors. Unlike purely criminal groups, HolyGhost is suspected of being leveraged for both revenue generation and strategic cyber operations in support of DPRK objectives.
Reports & references
- ransomlook.io — Holyghost (report)
- CISA — Aa22 187A (report)
- bleepingcomputer.com — Us Govt Links North Korean Holyghost Ransomware To Lazarus Group (report)
- Microsoft — Holyghost North Korean Threat Actor Uses Custom Ransomware In Attacks (report)