Security Resilience

Threat actor · all actors

Storm-0530MISP-47945864 state

🇰🇵 KP

aka Storm-0530, DEV-0530, H0lyGh0st

Last updated: 2026-10-16

44attributed CVEs
0ATT&CK techniques
117.8IDF score (tooling uniqueness)
0exclusive CVEs
2018–2025years active

About this actor

H0lyGh0st is a North Korean threat actor that has been active since June 2021. They are responsible for developing and deploying the H0lyGh0st ransomware, which targets small-to-medium businesses in various sectors. The group employs "double extortion" tactics, encrypting data and threatening to publish it if the ransom is not paid. There are connections between H0lyGh0st and the PLUTONIUM APT group, indicating a possible affiliation.

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

Microsoftweather-system names

Storm-0530

Unclassifiedno scheme matched

DEV-0530H0lyGh0st

How we know this

Data origin
MISP threat-actor galaxy Imported from the open-source MISP threat-actor galaxy.
Techniques
No ATT&CK techniques mapped.
Named victims
None on file.

Thin data: No ATT&CK techniques are mapped yet — the behavioural profile is empty.

See how actor data is built for the full pipeline.

Activity timeline

2018: 1 CVE published120182019: 3 CVE published320192021: 8 CVE published2021: 4 KEV added1220212022: 14 CVE published2022: 9 KEV added2320222023: 18 CVE published2023: 15 KEV added3320232025: 1 KEV added12025
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2019-7609 KEV10.010.00.97342019-03-25see CVE
CVE-2021-44228 KEV10.010.01.00002021-12-10see CVE
CVE-2022-22947 KEV10.010.00.98252022-03-03see CVE
CVE-2023-46604 KEV10.010.00.99892023-10-27see CVE
CVE-2019-0708 KEV9.99.81.00002019-05-16see CVE
CVE-2021-20028 KEV9.99.80.85852021-08-04see CVE
CVE-2021-20038 KEV9.99.80.99912021-12-08see CVE
CVE-2021-3018 9.99.80.79332021-01-05see CVE
CVE-2021-41773 KEV9.99.80.99992021-10-05see CVE
CVE-2021-45837 9.99.80.81082022-04-25see CVE
CVE-2022-22965 KEV9.99.80.99722022-04-01see CVE
CVE-2022-41352 KEV9.99.80.97012022-09-26see CVE
CVE-2022-47966 KEV9.99.80.99752023-01-18see CVE
CVE-2023-25690 9.99.80.84512023-03-07see CVE
CVE-2023-27997 KEV9.99.80.92422023-06-13see CVE
CVE-2023-28771 KEV9.99.80.99282023-04-25see CVE
CVE-2023-33010 KEV9.99.80.29022023-05-24see CVE
CVE-2023-33246 KEV9.99.80.97362023-05-24see CVE
CVE-2023-34362 KEV9.99.80.99932023-06-02see CVE
CVE-2023-35078 KEV9.99.81.00002023-07-25see CVE
CVE-2023-3519 KEV9.99.80.99752023-07-19see CVE
CVE-2023-42793 KEV9.99.80.99992023-09-19see CVE
CVE-2022-25064 9.79.80.63102022-02-25see CVE
CVE-2023-2868 KEV9.79.40.91452023-05-24see CVE
CVE-2023-3079 KEV9.28.80.37862023-06-05see CVE
CVE-2023-32315 KEV9.28.61.00002023-05-26see CVE
CVE-2021-44142 9.18.80.74042022-02-21see CVE
CVE-2021-36955 KEV8.57.80.26462021-09-15see CVE
CVE-2021-43226 KEV8.57.80.12292021-12-15see CVE
CVE-2022-24990 KEV8.57.50.96752023-02-07see CVE
CVE-2022-30190 KEV8.57.80.99372022-06-01see CVE
CVE-2023-32784 8.47.50.76482023-05-15see CVE
CVE-2022-27925 KEV8.17.20.98682022-04-21see CVE
CVE-2023-0669 KEV8.17.21.00002023-02-06see CVE
CVE-2022-21882 KEV7.97.00.90452022-01-11see CVE
CVE-2022-22005 7.78.80.17212022-02-09see CVE
CVE-2019-15637 7.48.10.22732019-08-26see CVE
CVE-2022-24665 7.49.90.02622022-02-16see CVE
CVE-2022-24663 7.39.90.02102022-02-16see CVE
CVE-2022-24664 7.39.90.01662022-02-16see CVE
CVE-2021-40684 7.19.10.01252021-09-22see CVE
CVE-2023-21932 7.17.20.44962023-04-18see CVE
CVE-2022-24785 6.97.50.13902022-04-04see CVE
CVE-2017-4946 5.97.80.00532018-01-05see CVE

No techniques attributed.

Co-occurring actors

Similar actors

Overlapping CVEs

Active in same years

Same nation-state

Same category