Glossary term
Ransomware
Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.
Read more
Ransomware group profile
Vice Society
Vice Society is an intrusion, exfiltration and extortion group that first appeared in summer 2021, per joint advisory AA22-249A (FBI, CISA and MS-ISAC, September 6, 2022).
In short
Vice Society is an intrusion, exfiltration and extortion group that first appeared in summer 2021, per joint advisory AA22-249A (FBI, CISA and MS-ISAC, September 6, 2022). The advisory says its actors disproportionately targeted the education sector and used other groups' ransomware rather than their own.
- Entry Routes6ways inCompromised credentials · Internet-facing applications · Evasion by masquerading
- Techniques3mapped to MITRE ATT&CKData Encrypted for Impact
- Defences7first steps listedUse phishing-resistant MFA · Patch known exploited flaws
Overview
Vice Society is described in joint advisory AA22-249A as an intrusion, exfiltration and extortion hacking group that first appeared in summer 2021. The advisory was written by the FBI, CISA and the Multi-State Information Sharing and Analysis Center (MS-ISAC) and first published on September 6, 2022. It rests on FBI investigations as recently as September 2022.
Who it targets
The three agencies say they recently saw Vice Society actors disproportionately targeting the education sector. Schools from kindergarten to twelfth grade (K-12) have been frequent ransomware targets for years. The advisory lists delayed exams, canceled school days and theft of personal data about students and staff. It expected more attacks as the 2022/2023 school year began. It says districts with limited cybersecurity capability are often the most vulnerable, but districts with strong programs can still be hit because criminals choose targets by opportunity.
What makes it distinct
The group does not use ransomware of its own. The advisory says its actors have deployed versions of Hello Kitty/Five Hands and Zeppelin ransomware, and may use other variants later. Before encrypting, they spend time inside the network, look for more access and copy data out. This is double extortion: a threat to publish sensitive data unless a ransom is paid.
The advisory names SystemBC, PowerShell Empire and Cobalt Strike as tools used to move sideways. Cobalt Strike is a commercial remote access tool that criminals also misuse. The actors also use built-in Windows features such as Windows Management Instrumentation (WMI), which is called living off the land because it avoids bringing in new tools. They have exploited the PrintNightmare flaws (CVE-2021-1675 and CVE-2021-34527) to gain higher privileges.
Locking victims out
The advisory says actors have reached domain administrator accounts and run scripts to change the passwords of victims’ network accounts, so the victim cannot recover. It also says they run a script to change the passwords of victims’ email accounts.
Persistence and evasion
The advisory says actors use scheduled tasks, create undocumented autostart Registry keys, and point legitimate services to their own malicious DLLs through DLL side-loading. To avoid detection they masquerade malware and tools as legitimate files and use process injection, and they likely use techniques to defeat automated dynamic analysis.
ATT&CK techniques in the advisory
The advisory maps the activity to ATT&CK techniques that include Exploit Public-Facing Application (T1190), Valid Accounts (T1078), Windows Management Instrumentation (T1047), Scheduled Task/Job (T1053), DLL (T1574.001), Exploitation for Privilege Escalation (T1068), Masquerading (T1036), Process Injection (T1055), Data Encrypted for Impact (T1486) and Account Access Removal (T1531).
- Summer 2021First appearanceThe advisory says the group first appeared in summer 2021.
- September 2022FBI investigationsIndicators in the advisory come from FBI incident response work as recently as September 2022.
- September 6, 2022Advisory publishedFBI, CISA and MS-ISAC released AA22-249A.
- School year 2022/2023Rise expectedThe agencies expected attacks on schools to increase as the school year began.
- First seen
- Summer 2021
- Main advisory
- AA22-249A, September 6, 2022
- Authors
- FBI, CISA, MS-ISAC
- Focus
- Education sector, especially K-12
- Ransomware used
- Hello Kitty/Five Hands and Zeppelin versions
- Extortion
- Double extortion
How they get in
-
01
Compromised credentials
The advisory says actors likely get in through compromised valid accounts.
-
02
Internet-facing applications
Actors exploit vulnerabilities in systems exposed to the internet to reach victim networks.
-
03
PrintNightmare for higher privileges
After access, actors were seen exploiting CVE-2021-1675 and CVE-2021-34527 to escalate privileges.
-
04
Persistence by DLL side-loading
The advisory says actors use scheduled tasks, undocumented autostart Registry keys and DLL side-loading to keep access.
-
05
Evasion by masquerading
Actors masquerade malware and tools as legitimate files and use process injection, per the advisory.
-
06
Account lockout
The advisory maps password-changing scripts to Account Access Removal (T1531), used to stop victims from remediating.
How they extort
Double extortion, per the advisory: data is copied out before ransomware is deployed, and victims are threatened with public release of sensitive data unless they pay. The advisory lists a Tor address and OnionMail email accounts as indicators.
Who they target
-
01
Education (K-12 in particular)
See the industry page
Tools and malware
Techniques
- Technique Data Encrypted for Impact Data Encrypted for Impact is when attackers encrypt files or whole systems so the owner can no longer use them, and then hold back the key. T1486 · Impact
- Technique Exploit Public-Facing Application Exploit Public-Facing Application is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network. T1190 · Initial Access
- Technique Exploitation for Privilege Escalation Exploitation for privilege escalation is when an attacker uses a flaw in software to gain higher permissions than they started with. T1068 · Privilege Escalation
How to defend
-
Keep offline, immutable backups
Maintain offline backups, make sure backup data is encrypted and cannot be altered or deleted, and test restoration regularly.
-
Use phishing-resistant MFA
Require it for all services where possible, especially webmail, VPNs and accounts that reach critical systems.
-
Patch known exploited flaws
Keep systems up to date and patch vulnerabilities on CISA's Known Exploited Vulnerabilities catalog first.
-
Secure remote desktop
Restrict and monitor RDP, require MFA, lock accounts after repeated failures and disable unused ports such as 3389.
-
Segment the network
Control traffic between subnetworks to limit sideways movement.
-
Audit accounts
Review domain controllers, servers and workstations for new or unrecognized accounts and apply least privilege to admin accounts.
-
Restrict SMB and review vendors
Limit SMB to necessary servers, disable SMBv1, and monitor connections with third-party vendors.
Questions
What is Vice Society?
Vice Society is described in joint advisory AA22-249A as an intrusion, exfiltration and extortion group that first appeared in summer 2021. The advisory was written by the FBI, CISA and MS-ISAC and published on September 6, 2022.
Who does Vice Society target?
The three agencies say they saw Vice Society actors disproportionately targeting the education sector, especially schools from kindergarten to twelfth grade. They add that districts with strong programs can still be hit, because criminals pick targets by opportunity.
How does Vice Society get into a network?
The advisory says actors likely get in through compromised valid accounts, and also exploit vulnerabilities in internet-facing systems. After access, they were seen exploiting the PrintNightmare flaws, CVE-2021-1675 and CVE-2021-34527, to gain higher privileges.
Does Vice Society use its own ransomware?
No. The advisory says the group does not use ransomware of its own. Its actors have deployed versions of Hello Kitty/Five Hands and Zeppelin ransomware, and they may use other variants later.
How can organizations defend against Vice Society?
The advisory advises offline, immutable backups that are tested, phishing-resistant multifactor authentication, patching known exploited flaws first, securing remote desktop, segmenting the network and auditing accounts for new or unrecognized entries.
Which ATT&CK techniques does the Vice Society advisory list?
They include T1190 Exploit Public-Facing Application, T1078 Valid Accounts, T1047 WMI, T1053 Scheduled Task/Job, T1574.001 DLL, T1068 Exploitation for Privilege Escalation, T1486 Data Encrypted for Impact and T1531 Account Access Removal.
What tools does Vice Society use to move sideways?
The advisory names SystemBC, PowerShell Empire and Cobalt Strike, plus built-in Windows features such as WMI.
Sources
- #StopRansomware: Vice Society (AA22-249A) CISA, FBI and MS-ISAC
- #StopRansomware Guide CISA
- Cobalt Strike, Software S0154 MITRE ATT&CK
- Known Exploited Vulnerabilities Catalog CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.