Vice Society — Ransomware Profile
Vice Society is a ransomware group that does not develop its own malware, instead deploying existing variants against schools, hospitals, and manufacturers.Also tracked as
TAC5279, DEV-0832, Vanilla Tempest
Tools & malware
- BlackCat (ALPHV) Ransomware/Encryptor
- Cobalt Strike Post-exploitation framework
- HelloKitty/Five Hands Ransomware/Encryptor
- MegaSync Exfiltration
- ntdsutil Credential access
- PolyVice Ransomware/Encryptor
- PortStarter Backdoor
- PsExec Lateral movement
- QuantumLocker Ransomware/Encryptor
- Rclone Exfiltration
- SystemBC Backdoor/Proxy
- Zeppelin Ransomware/Encryptor
Vendor research
- #StopRansomware: Vice Society (AA22-249A) CISA
- DEV-0832 (Vice Society) opportunistic ransomware campaigns impacting US education sector Microsoft
- Custom-Branded Ransomware: The Vice Society Group and the Threat of Outsourced Development SentinelOne
- Same threats, different ransomware Sophos
- Vice Society ransomware gang switches to new custom encryptor BleepingComputer