vicesociety

T1078Valid Accounts

Compromised credentials obtained via phishing or credential markets used to authenticate to victim systems via RDP or VPN.

T1190Exploit Public-Facing Application

Vice Society exploited PrintNightmare (CVE-2021-1675/CVE-2021-34527) and other publicly disclosed vulnerabilities in internet-facing systems as a primary initial access vector.

T1059.001Command and Scripting Interpreter: PowerShell

PowerShell used for payload execution, post-exploitation activity, and lateral movement.

T1059.003Command and Scripting Interpreter: Windows Command Shell

cmd.exe used for executing commands and batch scripts during intrusion.

T1068Exploitation for Privilege Escalation

PrintNightmare exploited for local privilege escalation to SYSTEM and for lateral movement via Windows Print Spooler.

T1070.001Indicator Removal: Clear Windows Event Logs

Event logs cleared using wevtutil to remove forensic artifacts.

T1562.001Disable or Modify Tools

AV and EDR solutions disabled via PowerShell and registry modifications before payload deployment.

T1003.001OS Credential Dumping: LSASS Memory

Mimikatz used for credential dumping from LSASS memory.

T1003.003OS Credential Dumping: NTDS

NTDS.dit extracted using ntdsutil or VSS to harvest domain credentials.

T1046Network Service Discovery

Network scanning to enumerate hosts and services within the victim environment.

T1021.001Remote Services: Remote Desktop Protocol

RDP used for lateral movement with harvested credentials.

T1021.002Remote Services: SMB/Windows Admin Shares

SMB and PsExec used to propagate payloads and move laterally across the network.

T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage

Data exfiltrated using Rclone and MegaSync to cloud storage for double extortion.

T1219Remote Access Software

SystemBC RAT and legitimate remote access tools used for persistent C2.

T1486Data Encrypted for Impact

Vice Society deploys third-party ransomware payloads (HelloKitty, Zeppelin, RedAlert, QuantumLocker, and custom 'ViceSociety' encryptor). Heavily targets the education and healthcare sectors. Double extortion via dedicated leak site.

T1490Inhibit System Recovery

Shadow copies deleted and backup services disabled to prevent recovery.