Holyghost

Status

active

First seen

—

Last activity

4 years ago

Onion sites

1 known endpoint

External sources curated by the MISP threat-intel community.

• ransomlook.io/group/holyghost
• cisa.gov/news-events/cybersecurity-advisories/aa22-187a
• bleepingcomputer.com/news/security/us-govt-links-north-korean-holyghost-ransomware-to-lazarus-group/
• microsoft.com/en-us/security/blog/2022/07/14/holyghost-north-korean-threat-actor-uses-custom-ransomware-in-attacks/

Loading…

• http://matmq3z3hiovia3voe2tix2x54sghc3tszj74xgdy4tqtypoycszqzqd.onion

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.