Vice Society is a lesser-known ransomware group that buys and modifies ransomware payloads developed by RaaS groups such as HelloKitty and Zeppelin. Vice Society publishes a list of its victims in its Data Leak Site (DLS) and releases its victims’ exfiltrated data on the DLS if they do not pay the ransom. Ransomware groups often avoid healthcare and government organizations; however, Vice Society does not refrain from targeting any industry.
Ransomware
Metadata
Associated Groups | Affiliates - HelloKitty ransomware, Zeppelin ransomware |
Associated Country | - |
First Seen | June 2021 |
Target Sectors | Construction, Education, Entertainment, Financial Services, Government, Healthcare, Hospitality, Insurance,Manufacturing, Retail, Utilities, Telecommunications |
Target Countries | Argentina, Austria, Brazil, Canada, Colombia, France, Germany, Greece, Indonesia, Italy, Malaysia, New Zealand, Netherlands, Saudi Arabia, Spain, Sweden, Thailand, United Kingdom, United States |
Modus Operandi
Business Models | Ransomware-as-a-Service (RaaS) affiliate Triple Extortion |
Extortion Tactics | File Encryption Data Leakage |
Initial Access Methods | Exploit Public-Facing Application Phishing External Remote Services |
Impact Methods | Data Encryption Data Exfiltration |
Exploited Applications and Vulnerabilities by Vice Society
Application | Vulnerability | CVE | CVSS |
|---|---|---|---|
Windows Print Spooler | Remote Code Execution | 8.8 High | |
Windows Print Spooler | Remote Code Execution | 8.8 High |
Utilized Tools and Malware by Vice Society
MITRE ATT&CK Tactic | Tools |
Execution | PsExec Proxychains WMI |
Defence Evasion | Reg.exe Wevtutil |
Credential Access | NTDSUtil |
Discovery | Net.exe Nltest |
Lateral Movement | Mstsc PsExec |
Impact | HelloKitty Ransomware (modified) Zeppelin Ransomware (modified) |
-3.png?width=734&height=464&name=image%20(61)-3.png)
