Lessons from the Holy Ghost Ransomware Attacks

Ransomeware has become one of the defining malware types in the last few years. Locking, encrypting, and basically deleting the original data from the victim’s PC, the hackers, or let’s just call them cyber criminals, then seek to extort money for them in return for restored access to your critical data.

In the meantime, you have utterly no idea what’s been accessed and stolen, or if your extorted funds will even result in the release of your data. One of the most current threats, the so-called Holy Ghost Ransomware, or Sienne Purple, has several key lessons in cybersecurity to teach us. Let’s take a look.

Cybersecurity: Thinking Small

Originating in North Korea, the Holy Ghost ransomware operation has preyed primarily on small businesses, but that doesn’t mean larger businesses can ignore it. This is an interesting shift of focus, and highlights a key lesson straight out the gate- cybersecurity is now no longer just for ‘big’ or ‘important’ businesses.

With the pandemic-accelerated shift to online and remote work, staying safe in cyberspace has become a business-critical concern. It’s easy to assume you are too small or too ‘uninteresting’ to cyber criminals and hackers, but in a world that’s ever-increasingly connected, this is no longer a safe stance to assume.

Hackers know that small enterprises are less likely to have safety controls in place, making them a juicy target ‘market’ that’s likely to grow as a target demographic. It’s no longer safe to assume any business, no matter their digital presence, can slide on security precautions.

Luckily, we’re seeing a concurrent rise in focus on products aimed to help tighten and enhance security across a range of industries, combining scalability, affordability, and ease of use with fast deployment. Perimeter 81, for example, has a full suite unified business security solution, making security for your workers across regions and the globe a simple process.

The Double Extortion

We’ve also seen a swing to double extortion attempts in recent Ransomware attacks. Alongside the typical play for cash to return data, there’s also the threat of publishing the victim’s name and stolen data to the wider dark web.

Do note that Holy Ghost, particularly, rarely actually delivers the decryption key or your software returned. Sadly, decryption is usually impossible without it, too, so the chances of recovering data after a breach are minimal. As always, strong preventative security and solid backups are the only solutions.

Prevention is the only cure, here. Victims are highly advised not to pay the ransom over, as it simply goes to support further illegal activity. The ransom is typically asked for in Bitcoin.

Holy Ghost Ransomware Gang’s note

1. US charges 3 North Korean hackers for extorting $1.3+ billion
2. Beware of Fake Windows 11 Downloads Distributing Vidar Malware
3. New Scam Utilizing AI-Generated Images to Represent Fake Law Firm
4. Elite North Koreans aren’t opposed to exploiting internet for financial gain
5. Hackers Used Fake LinkedIn Job Offer to Hack Off $625M from Axie Infinity

Evolving Ransomware

Holy Ghost itself was first classified as Sienna Purple by the Microsoft Threat Intelligence Center (MSTIC). It started last June as a relatively unsophisticated BTLC_C.exe form. In October 2021, the Go-based variants, now classified as SiennaBlue (HolyRS.exe, HolyLocker.exe, and BTLC.exe) have greatly expanded functionality.

You will now find internet/intranet support, multiple encryption options, public key management, and string obfuscation as standard. The ransomware gang itself is being traced as DEV-0530. They have some connection to the PLUTONIUM, or DarkSeoul, gang. The encrypted files typically end with the .h0lyenc suffix. Microsoft’s full report has more.

The Importance of Security Updates

Common targets have been schools, banks, social/event planning companies, and manufacturing organizations. Most of these likely became targets of opportunity through vulnerabilities in public-facing web applications or their content-management systems as original points of access. In fact, the DotCMS remote code execution vulnerability, CVE-2022-26352, is thought to have been a key access point.

This highlights another critical point in the modern digital business environment- small and public institutions like these often fail to regularly maintain and update their OSs and programs across their organizations. And all it takes is one vulnerable PC on the network for the whole system to be infiltrated.

While enterprise-level companies tend to have better update policies in place, you’re never too large to check in on your regular IT maintenance protocols- a mistake in a large organization can easily be more costly.

Regular security updates are issued by most mainstream platforms, but many organizations lack a cohesive maintenance policy, and many workers are under-educated in the importance of cybersecurity tasks like security updates. They simply click away from the nag screen and return to work. After all, IT will handle that, right?

The need for cohesive and organization-wide education on the risks of cybercrime is critical but often neglected, especially in business.

Being Careful With Trust

Currently, the Holy Ghost website is down, and it may stay down, but it’s also critical to note that they were leveraging their limited online presence to pose as a legitimate cybersecurity entity, actively promising to help visitors ‘improve’ their online security presence.

Of course, one malicious entity masquerading as a legitimate cybersecurity company doesn’t mean all smaller cybersecurity companies are fake. However, the need for informed due diligence and being careful to work with well-known, trusted, and verified products/brands is clear. Again, they are trying to leverage the general public and business owners’ lack of knowledge about cybercrime and its infiltration methods to lure victims in.

Political Interference

This is certainly not a new feature, nor one unique to Holy Ghost, but it bears repeating- many ransomware efforts show signs of hostile political interference at their core. As with the Maui ransomware currently predating on healthcare organizations, there are some links to the North Korean government itself in the Holy Ghost attacks. As the international stage gets more and more politically fraught, this is a pattern we’re likely to see evolve.

As with all ransomware, the key takeaways from Holy Ghost ransomware include the need to invest in secure systems, no matter what size of business you are running. Deploying effective cybersecurity is a must of working in the digital age.

Always have secure backups through a variety of mediums, and make sure to stage them across time periods, so you don’t end up in the unenviable position where the backup carries over the virus.

Communicating cybersecurity risks to staff members is essential. Ransomware commonly spreads through phishing emails, remote desktop protocols that are not correctly secured or communicated, infected downloads from compromised sites, and the insertion of infected media and USB devices.

Ensuring staff is knowledgeable about these risks is one of the best possible investments, alongside proper security protocols and updates.

Ransomware as a malicious software category is set to grow further over the coming years, as more workspaces enter the digital environment. Having proper preventative protocols in place is a must.

More Ransomware News

1. Conti Ransomware Gang Hits German Wind Turbine Giant Nordex
2. GoodWill Ransomware demands food for the poor to decrypt locked files
3. Cardiologist Charged for Developing Jigsaw v.2 and Thanos Ransomware
4. PoC Shows IoT Devices Vulnerable to Install Ransomware on OT Networks