Loading threat actor…
Vanilla Tempest, also tracked as TAC5279 and formerly as DEV-0832, is a ransomware affiliate intrusion cluster associated with enterprise compromises observed from late 2022 through mid-2023. The cluster is notable for maintaining a consistent operational playbook while switching ransomware payloads from Vice Society to Rhysida, reflecting affiliate mobility within the ransomware-as-a-service ecosystem rather than a confirmed rebrand of the malware operators themselves. The actor has targeted organizations in government, logistics, education, and manufacturing. Initial access has been repeatedly associated with the use of valid VPN credentials on accounts lacking multi-factor authentication. After access, the cluster conducts internal discovery, credential access, lateral movement, data theft, and finally ransomware deployment. In at least one case, the actor also exploited CVE-2020-1472 (ZeroLogon) to compromise a domain controller. Vanilla Tempest commonly performs reconnaissance with administrative and network-enumeration utilities and uses Remote Desktop Protocol extensively for lateral movement, with additional use of SSH tooling and PsExec for remote execution. Credential theft has included dumping Active Directory database contents and extracting credentials from LSASS. The cluster has also used backdoor and proxy tooling for command and control and persistence, notably PortStarter in earlier Vice Society-linked intrusions and SystemBC in both Vice Society and Rhysida activity, with SystemBC becoming more prominent in later Rhysida cases. Persistence has been established through scheduled tasks and autorun mechanisms. The actor routinely attempts data collection and exfiltration before encryption, often using common archiving, file-transfer, and remote-access tools. This supports a double-extortion model in which stolen data is used to pressure victims in addition to file encryption. Observed dwell times have ranged from several days to multiple months, indicating patience and operational discipline in some intrusions.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
15 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
6 malware families Mallory has associated with this actor across public reporting.
1 additional family tracked in Mallory.
1 CVE Mallory has associated with this actor across public reporting. 1 of them is exploited in the wild (not necessarily by this actor).
5 indicators attributed to this actor. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.