HolyGhost’s Bargain Basement Approach to Ransomware

HolyGhost is a North Korea-linked ransomware group that targets small and medium-sized enterprises with double-extortion operations and a poorly maintained data-leak site; the group charges unusually low ransoms and appears connected to DPRK APT activity (e.g., DarkSeoul/Lazarus). The report assesses operational challenges (infrastructure, talent, state revenue extraction) and likely continued SME-focused financially motivated activity, noting limited visibility into scale and few posted victims.