# DPRK ransomware targets healthcare and critical infrastructure

Published: 2025-08-05 · Severity: high · Sectors: healthcare, government-national, defense, infrastructure, manufacturing
Canonical: https://vorant.io/reports/e5b0c43b-7d07-52fe-8323-64e8b55807c3/dprk-ransomware-targets-healthcare-and-critical-infrastructure

> North Korean state-sponsored actors deploy Maui and H0lyGh0st ransomware against healthcare and critical infrastructure via exploited CVEs and supply-chain compromise.

This joint CISA/NSA/FBI advisory details North Korean state-sponsored ransomware campaigns targeting US and South Korean healthcare organizations and critical infrastructure. DPRK cyber actors exploit vulnerabilities including Apache Log4Shell (CVE-2021-44228), SonicWall SMA 100 remote code execution flaws (CVE-2021-20038, CVE-2022-24990), and weaponize trojanized versions of X-Popup, a messenger application widely used by Korean hospital staff. Attackers gain initial access, move laterally using staged payloads and custom malware, then deploy Maui or H0lyGh0st ransomware. They demand bitcoin ransoms and threaten to expose proprietary data to competitors. Revenue from ransomware and cryptocurrency operations funds DPRK national-level cyber operations against US and South Korean government targets, including Department of Defense networks and Defense Industrial Base entities.

DPRK actors obfuscate their involvement through third-party intermediaries, use VPNs and VPSs to mask their location, and communicate ransom demands via Proton Mail. The advisory includes 38 bitcoin wallet addresses used for ransom collection and extensive indicators of compromise including malware hashes and command infrastructure. Healthcare and critical infrastructure organizations should prioritize patching Log4j and SonicWall vulnerabilities, isolate backups, implement network segmentation, require MFA for remote access, and report incidents immediately to FBI, CISA, or Korean authorities.

## Mentioned in this report

- Vulnerabilities: CVE-2021-20038 (KEV), CVE-2021-44228 (KEV), CVE-2022-24990 (KEV)
- Threat actors: North Korea-nexus activity (unattributed)
- Malware: H0lyGh0st, Maui, X-Popup trojanized variant

## Detection guidance (public sample)

### Log4Shell JNDI Lookup Exploitation Attempt in Web Request

ATT&CK: T1190

Detects Log4Shell (CVE-2021-44228) exploitation attempts, including common obfuscated variants, in web request URI query strings. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Log4Shell JNDI Lookup Exploitation Attempt in Web Request
description: Detects JNDI lookup strings (plain and common obfuscations) in web request
  URI queries, the initial-access vector for Apache Log4Shell CVE-2021-44228 exploited
  by DPRK ransomware actors. Matches the exploit pattern, not specific callback hosts.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_plain:
    cs-uri-query|contains:
    - '${jndi:'
    - '%24%7bjndi:'
    - '%24%7Bjndi:'
  selection_obfuscated:
    cs-uri-query|contains:
    - ${${lower:j
    - ${${upper:j
    - ${${::-j
    - '${${env:'
    - ${j${
  selection_ua:
    cs-user-agent|contains:
    - '${jndi:'
    - ${${lower:j
    - ${${::-j
  condition: 1 of selection_*
falsepositives:
- Authorized vulnerability scanners probing for Log4Shell
- Security testing or red team exercises
level: high
id: ff5ff4ee-f17c-5bcb-af3c-b2cdc9b1e9c3
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-040a
```

### Java Process Spawning Shell With Download or Encoded Command

ATT&CK: T1190

Java server process spawning cmd/PowerShell with download cradles or encoded commands, indicating post-exploitation of a public-facing Java app such as Log4Shell. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Java Process Spawning Shell With Download or Encoded Command
description: Detects java.exe/javaw.exe spawning cmd.exe or PowerShell with download-cradle,
  encoded-command or LOLBin download arguments. This is typical post-exploitation
  after Log4Shell RCE on a public-facing Java application, used to stage payloads
  for lateral movement and ransomware deployment.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  selection_cmd:
    CommandLine|contains:
    - DownloadString
    - DownloadFile
    - Invoke-WebRequest
    - Net.WebClient
    - certutil
    - bitsadmin
    - 'curl '
    - 'wget '
    - ' -enc '
    - ' -EncodedCommand'
    - FromBase64String
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Java-based build or deployment tools (e.g. Jenkins agents) running scripted downloads
- Java application installers invoking PowerShell to fetch components
level: high
id: 0875600a-dd4d-5ed8-b04f-d03f1bbeb85e
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-040a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

3 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-040a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e5b0c43b-7d07-52fe-8323-64e8b55807c3/dprk-ransomware-targets-healthcare-and-critical-infrastructure.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup