DEV-0530, a North Korea-origin ransomware cluster with suspected overlap with PLUTONIUM/Andariel tooling and infrastructure, used H0lyGh0st ransomware against small and midsize businesses from at least September 2021. The campaign encrypted Windows systems with SiennaPurple and SiennaBlue variants, used the .h0lyenc extension, demanded Bitcoin payments, and applied double-extortion pressure by threatening to publish or share victim data.