HackerFeeds
All ransomware groups

vicesociety

188 tracked victims
·first seen 2021-05-31·last activity 2023-06-20

Activity analysis

HackerFeeds has tracked 188 victims claimed by vicesociety since May 2021, most recently in June 2023 — ranking #37 of 332 groups (0.6% of all tracked ransomware victims). No new victims have been posted in the last 180 days; the most recent claim was in June 2023. Its most-targeted sector is Education (63 victims), followed by Public Sector (17). The United States accounts for 7 victims (17% of those with a known location); 147 victims did not disclose a location.

Victims per year

  • 20212
  • 2022141
  • 202345

Top sectors

  • Education63
  • Public Sector17
  • Healthcare17
  • Manufacturing16
  • Business Services11
  • Financial Services10

Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology

Group profile

Vice Society ransomware appends the .v-society extension when encrypting Linux machines. Running a leak site on the darkweb, Possible relations with "HelloKitty"

MITRE ATT&CK TTPs

TA0001

Initial Access

  • T1078Valid Accounts

    Compromised credentials obtained via phishing or credential markets used to authenticate to victim systems via RDP or VPN.

  • T1190Exploit Public-Facing Application

    Vice Society exploited PrintNightmare (CVE-2021-1675/CVE-2021-34527) and other publicly disclosed vulnerabilities in internet-facing systems as a primary initial access vector.

TA0002

Execution

  • T1059.001Command and Scripting Interpreter: PowerShell

    PowerShell used for payload execution, post-exploitation activity, and lateral movement.

  • T1059.003Command and Scripting Interpreter: Windows Command Shell

    cmd.exe used for executing commands and batch scripts during intrusion.

TA0004

Privilege Escalation

  • T1068Exploitation for Privilege Escalation

    PrintNightmare exploited for local privilege escalation to SYSTEM and for lateral movement via Windows Print Spooler.

TA0005

Defense Evasion

  • T1070.001Indicator Removal: Clear Windows Event Logs

    Event logs cleared using wevtutil to remove forensic artifacts.

  • T1562.001Disable or Modify Tools

    AV and EDR solutions disabled via PowerShell and registry modifications before payload deployment.

TA0006

Credential Access

  • T1003.001OS Credential Dumping: LSASS Memory

    Mimikatz used for credential dumping from LSASS memory.

  • T1003.003OS Credential Dumping: NTDS

    NTDS.dit extracted using ntdsutil or VSS to harvest domain credentials.

TA0007

Discovery

  • T1046Network Service Discovery

    Network scanning to enumerate hosts and services within the victim environment.

TA0008

Lateral Movement

  • T1021.001Remote Services: Remote Desktop Protocol

    RDP used for lateral movement with harvested credentials.

  • T1021.002Remote Services: SMB/Windows Admin Shares

    SMB and PsExec used to propagate payloads and move laterally across the network.

TA0010

Exfiltration

  • T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage

    Data exfiltrated using Rclone and MegaSync to cloud storage for double extortion.

TA0011

Command and Control

  • T1219Remote Access Software

    SystemBC RAT and legitimate remote access tools used for persistent C2.

TA0040

Impact

  • T1486Data Encrypted for Impact

    Vice Society deploys third-party ransomware payloads (HelloKitty, Zeppelin, RedAlert, QuantumLocker, and custom 'ViceSociety' encryptor). Heavily targets the education and healthcare sectors. Double extortion via dedicated leak site.

  • T1490Inhibit System Recovery

    Shadow copies deleted and backup services disabled to prevent recovery.

Recent victims

No victims tracked yet.