SentinelOne VS HolyGhost Ransomware – Detection & Response

HolyGhost ransomware targets large enterprises, governments, and financial institutions. It was first seen in June 2021 and tied to North Korean threat actors (DEV-0530 and DarkSeoul).
Technically, HolyGhost uses multi-extortion tactics, and attackers exfiltrate all enticing data before encrypting target devices. Victims are extorted into paying the ransom to prevent data leakage and the decryption of files. HolyGhost campaigns make extensive use of customized tools and tradecraft. Recent HolyGhost payloads can be traced back to SiennaPurple and SiennaBlue variations observed in 2021 (written in Go). Initial delivery can vary, though some attackers have located vulnerable, public-facing servers on which to exploit CVE-2022-26352.