Loading threat actor…
Vice Society is a financially motivated cybercriminal intrusion, ransomware, and extortion group first observed in summer 2021. Also tracked as Vanilla Tempest, DEV-0832, Vice Spider, and Rapid Brigantine, it disproportionately targets education, particularly K–12 schools and higher education institutions. Other targets include healthcare providers, government bodies, nongovernmental organizations, and manufacturers. Its victims are distributed globally, with the United States and United Kingdom especially prominent, and many are small or medium-sized organizations. The group conducts double extortion, stealing sensitive information before encrypting systems and threatening publication on a dedicated data leak site. It has deployed multiple ransomware families rather than relying on a single proprietary encryptor, including HelloKitty/Five Hands, Zeppelin, BlackCat, Quantum Locker, and Rhysida. Vanilla Tempest adopted INC Ransom as its primary payload in August 2024 and has operated as an INC affiliate. Its deployment of Rhysida does not establish that Vice Society and the entire Rhysida operation are identical. Initial-access methods include phishing, compromised accounts, exploitation of internet-facing applications, and access supplied through Gootloader infections. The group has exploited PrintNightmare vulnerabilities CVE-2021-1675 and CVE-2021-34527 for privilege escalation and lateral movement. It steals credentials from LSASS memory and Active Directory databases, performs network scanning and domain reconnaissance, and moves laterally using RDP, SMB, WMI, and PsExec. Its tooling includes SystemBC, PowerShell Empire, Cobalt Strike, and the Supper backdoor. Persistence mechanisms include scheduled tasks, services, registry autostart entries, and DLL sideloading. Defense evasion includes process injection, masquerading, log deletion, and interference with endpoint security. Vice Society also targets backups and changes compromised account passwords to obstruct recovery.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
53 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
25 malware families attributed to this actor across reporting.
20 additional families tracked in Mallory.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
Vice Society first surfaced in the summer of 2021, and in that time frame it was seen exploiting the CVE-2021-34527 (aka PrintNightmare) vulnerability as part of their attack chain.
"Zerologon is a critical-severity privilege escalation vulnerability in Microsoft’s Netlogon Remote Protocol (CVE-2020-1472, patched 11 August 2020), which attackers can exploit to gain administrative access to a Windows domain controller without any authentication"
115 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A cybercriminal group associated with multiple ransomware families, including Rhysida. The article connects previously attributed Vice Society tradecraft to a September incident involving ClickFix, Lorem Ipsum Loader and a Python tunnel client. Researchers contained the incident before ransomware deployment and assessed ransomware delivery as the likely objective; the article does not conclusively attribute this incident to Vice Society.
A cybercrime group associated with Rhysida ransomware. The investigated ClickFix infection chain exhibited similarities to activity previously linked to Vice Society, but the report does not attribute this incident to the group. Containment interrupted the chain before the suspected ransomware payload arrived; ransomware execution was not established.
A cybercriminal group previously linked to the Lorem Ipsum Loader campaign and associated Python tunneling tradecraft. The campaign evolved from SEO poisoning and trojanized installers to ClickFix and TerminalFix delivery. In the investigated September incident, Lorem Ipsum delivered a Python reverse-tunnel client, but containment prevented ransomware deployment. The report assesses ransomware deployment as the likely objective; it does not conclusively attribute this specific incident to Vice Society.
The article describes Vanilla Tempest staging payloads in hidden network shares and distributing Zeppelin and BlackCat ransomware through GPO, particularly against education organizations. It marks the attribution and technical details as unverified.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.