Cyberpoking publishes a YARA rule for the SiennaPurple variant of H0lyGh0st ransomware, an actor and malware family described as having ties to the DPRK-nexus Lazarus group. The rule matches strings from SiennaPurple binaries, including a PDB path, ransom note text, an onion service address, and the contact address [email protected]. It references SHA-256 99fc54786a72f32fd44c7391c2171ca31e72ca52725c68e2dde94d04c286fccd and requires a Windows PE header plus six matching strings. The source is a detection-focused post, so it is useful for hunting SiennaPurple samples but does not document a new victim intrusion.