While the use of H0lyGh0st ransomware in campaigns is unique to DEV-0530, MSTIC has observed communications between the two groups, as well as DEV-0530 using tools created exclusively by PLUTONIUM.Īs with any observed nation-state actor activity, Microsoft directly notifies customers that have been targeted or compromised, providing them with the information they need to secure their accounts.

MSTIC assesses that DEV-0530 has connections with another North Korean-based group tracked as PLUTONIUM (aka DarkSeoul or Andariel). This blog is intended to capture part of MSTIC’s analysis of DEV-0530 tactics, present the protections Microsoft has implemented in our security products, and share insights on DEV-0530 and H0lyGh0st ransomware with the broader security community to protect mutual customers. As part of their extortion tactics, they also threaten to publish victim data on social media or send the data to the victims’ customers if they refuse to pay. h0lyenc, send the victim a sample of the files as proof, and then demand payment in Bitcoin in exchange for restoring access to the files. The group’s standard methodology is to encrypt all files on the target device and use the file extension. onion site that the group uses to interact with their victims. This group, which calls itself H0lyGh0st, utilizes a ransomware payload with the same name for its campaigns and has successfully compromised small businesses in multiple countries as early as September 2021.Īlong with their H0lyGh0st payload, DEV-0530 maintains an. Microsoft Purview Data Lifecycle ManagementĪ group of actors originating from North Korea that Microsoft Threat Intelligence Center (MSTIC) tracks as DEV-0530 has been developing and using ransomware in attacks since June 2021.Microsoft Purview Information Protection.Information protection Information protection.Microsoft Priva Subject Rights Requests.

Microsoft Purview Communication Compliance.

Microsoft Purview Insider Risk Management.

Risk management & privacy Risk management & privacy.

Microsoft Defender External Attack Surface Management.

Microsoft Defender Vulnerability Management.

Azure Active Directory part of Microsoft Entra.

Smalland early access download