North Korean threat actors have been consistently targeting small/midsize businesses with ransomware strains since June 2021. These threat actors, who call themselves H0lyGh0st and are tracked as DEV-0530, have targeted organizations throughout several countries and industries including manufacturing, schools, event planning companies, and banks. As their tools of choice, H0lyGh0st leveraged SiennaPurple and SiennaBlue malware variants to deliver their end game ransomware. In most cases thus far, the point-of-compromise involved H0lyGh0st actors exploiting public facing web applications and management systems. Once compromised, one or both malware variants were deployed on the end user system and the exposed files were encrypted, exfiltrated, and uploaded to the group’s ransomware leak site. With economic setbacks from the Covid-19 pandemic and global sanctions, it comes as no surprise that some North Korean threat actors have shifted to ransomware. The Cybersecurity and Infrastructure Security Agency (CISA) recently distributed an alert about North Korean actors utilizing the Maui ransomware variant to target healthcare organizations, playing into increased financial motivation from North Korean backed threat organizations. There have been some overlaps between H0lyGh0st and other North Korean threat groups, specifically Plutonium. Some indicators of compromise tied to Plutonium were also observed with H0lyGh0st indicators, showing the same infrastructure and controllers alongside email communications to known Plutonium email accounts. On the contrary, these groups act differently as they target different industries and trades with their campaigns. CTIX analysts will continue to monitor threat actor activity worldwide and provide additional insight accordingly.