Vice Society
Vice Society is a ransomware operation first discovered in June 2021 that conducts double-extortion attacks, stealing victim data and threatening to leak it in addition to encrypting systems. Reporting in the provided content links it to attacks against healthcare, education, manufacturing, government/logistics, logistics, and other enterprise environments, with activity observed in countries including Brazil, Argentina, Switzerland, and Israel. It has been notably associated with attacks on schools and healthcare organizations, and one source notes claims against the Los Angeles School District and other educational institutions.
The group initially deployed third-party ransomware payloads including HelloKitty/Five Hands, Zeppelin, RedAlert, and later was reported to have developed custom ransomware, including a Trend Micro-tracked variant detected as Ransom.Win64.VICESOCIETY.A and a custom variant dubbed PolyVice. Secureworks tracks the broader criminal operation as Gold Victor. Multiple sources also state that an affiliate cluster later moved from deploying Vice Society to Rhysida while maintaining similar tradecraft, although the content does not establish that Vice Society itself definitively rebranded.
Observed initial access methods in the content include exploitation of the PrintNightmare vulnerability, exploitation of public-facing websites, abuse of compromised RDP credentials, valid VPN credentials without MFA, phishing, and in at least one case exploitation of ZeroLogon (CVE-2020-1472). Post-compromise activity includes use of Cobalt Strike, Rubeus, Mimikatz, PowerShell, PsExec, PuTTY/SSH, Advanced IP Scanner/Advanced Port Scanner, AnyDesk, WinSCP, MegaSync, 7zip, PortStarter, and SystemBC. Reported behaviors include disabling Windows Defender via registry changes, creating hidden administrator accounts, credential dumping including ntds.dit extraction and LSASS dumping, lateral movement over RDP, terminating security, SQL, backup, and business-critical processes, exfiltrating files, deleting shadow copies with vssadmin.exe Delete Shadows /All /Quiet, clearing event logs, and deleting RDP/terminal services traces.
File-encryption artifacts described in the content include the extensions .v1cesO0ciety and .vicesociety. Reported ransom notes include AllYFilesAE, !!! ALL YOUR FILES ARE ENCRYPTED !!!.txt, and contact addresses 876505846904@onionmail[.]org, 316186524106@onionmail[.]org, and v-society.official@onionmail[.]org. One Sophos case also noted a ransomware binary named svchost.exe and an appended marker vs_team. Additional infrastructure and tooling noted in the content include Cobalt Strike communication with 57thandnormal[.]com and PortStarter C2 IPs 156.96.62[.]58, 146.70.104[.]249, 51.77.102[.]106, 108.62.141[.]161, and 157.154.194[.]6. Trend Micro also observed the Neshta file infector during Vice Society attack activity. Virtualized environments, including Microsoft Hyper-V servers, were reported as affected.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Vice Society, which was initially reported to be exploiting the PrintNightmare vulnerability in their routines, have previously deployed ransomware variants such as Hello Kitty/Five Hands and Zeppelin... Our detection name for this variant of Vice Society’s ransomware is Ransom.Win64.VICESOCIETY.A. | Vice Society, which was initially reported to be exploiting the PrintNightmare vulnerability in their routines...
The situation began in June with CVE-2021-1675 ... There was confusion when researchers published a proof-of-concept (PoC) called “PrintNightmare,” stating it was for CVE-2021-1675 when it was actually a distinct vulnerability.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Vice Society, which was initially reported to be exploiting the PrintNightmare vulnerability in their routines, have previously deployed ransomware variants such as Hello Kitty/Five Hands and Zeppelin... Our detection name for this variant of Vice Society’s ransomware is Ransom.Win64.VICESOCIETY.A.
Secureworks calls that group Gold Victor and it operated a ransomware scheme called Vice Society.
"...we identified a ransomware affiliate group move from deploying Vice Society to leveraging Rhysida ransomware in attacks against enterprises."
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Lateral Movement
1 technique“In almost all the observed incidents, the threat actors used Remote Desktop Protocol (RDP) to move laterally...”
Impact
1 techniqueRansomware gangs render an organisation’s computers inaccessible by infecting them with malicious software – malware – and then demanding a payment, typically in cryptocurrency, to unlock the files.
IOCs tracked for this family
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ransomware group known for targeting organizations with human-operated campaigns, exploiting vulnerabilities in unsupported or unpatched Windows systems.
Ransomware strain used in extortion operations.
Vice Society is a ransomware scheme previously operated by the group Secureworks tracks as Gold Victor, which the article says later rebranded as Rhysida.
Ransomware family used by an affiliate cluster (TAC5279/Vanilla Tempest) to encrypt victim environments and conduct double-extortion. Noted behaviors include pre-encryption data theft and deployment via tools like WinSCP; observed file extension .vicesociety and ransom note name "!!! ALL YOUR FILES ARE ENCRYPTED !!!.txt".
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.