Loading story…
The FBI, CISA, and MS-ISAC issued a joint #StopRansomware advisory warning that the Vice Society intrusion and extortion group has disproportionately targeted the education sector, particularly K-12 schools. The group has caused network outages, delayed exams, canceled school days, and theft of student and staff personal information. Investigators said Vice Society has been active since at least summer 2021 and uses double extortion, stealing data before encrypting systems and threatening to publish it if victims refuse to pay.
Authorities said Vice Society does not depend on a single ransomware strain, instead deploying variants including Hello Kitty/Five Hands and Zeppelin. The group has gained access through exploitation of internet-facing applications and compromised credentials, then moved laterally using tools such as SystemBC, PowerShell Empire, and Cobalt Strike, while escalating privileges through PrintNightmare flaws CVE-2021-1675 and CVE-2021-34527. The advisory included indicators of compromise such as OnionMail addresses, a Tor leak site, command-and-control IP addresses, and file hashes, and urged organizations to prioritize patching known exploited vulnerabilities, enforce phishing-resistant MFA, maintain offline immutable backups, secure RDP, segment networks, and restrict SMB and other unnecessary ports.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The FBI, CISA, and MS-ISAC published a joint #StopRansomware advisory on Vice Society, detailing the group's tactics, use of ransomware variants such as Hello Kitty/Five Hands and Zeppelin, and recommended mitigations. The advisory warned that attacks had caused network outages, delayed exams, canceled school days, and theft of student and staff personal information.
FBI investigations identified Vice Society activity as recently as September 2022. Incident response work from that period produced indicators of compromise including OnionMail addresses, a Tor site, command-and-control IP addresses, and file hashes.
Vice Society, a ransomware-related intrusion, exfiltration, and extortion group, was first observed in summer 2021. The group was later noted for disproportionately targeting the education sector, especially K-12 institutions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities warned that malicious cyber actors were actively targeting K-12 schools and other educational institutions as remote learning expanded, using ransomware, malware, phishing, DDoS attacks, and video-conference intrusions to disrupt classes and steal sensitive data. The joint FBI, CISA, and MS-ISAC advisory said schools had become targets of opportunity, with ransomware incidents rising sharply and commonly involving **data theft and extortion**; families observed in attacks included `Ryuk`, `Maze`, `Nefilim`, `AKO`, and `Sodinokibi/REvil`, while malware such as `ZeuS` and `Shlayer` also affected the sector. Separate reporting on criminal forums showed underground sellers offering remote access to compromised schools and universities in the U.S., U.K., Australia, Israel, and Germany, with listings priced from **$200 to $17,000** based on victim size and privilege level. The activity coincided with leaked credentials, exposed FTP servers, and student-data incidents tied to education and e-learning platforms, reinforcing concerns about weak remote-access security, exposed `RDP` and `SMB` services, end-of-life software, and third-party edtech risks; officials urged patching, MFA, network segmentation, offline backups, DDoS protections, tighter conferencing controls, and stronger vetting of service providers.
Aug 15, 2026
U.S. and European authorities warned that the **PYSA** ransomware group, also tracked as **Mespinoza**, was conducting double-extortion attacks against education and government organizations after stealing data and then encrypting Windows and Linux systems. The FBI said incidents affected higher education, K-12 schools, and seminaries across 12 U.S. states and the United Kingdom, while France's CERT-FR reported related intrusions against local government authorities. Stolen information included employment records, personally identifiable information, and payroll tax data, with victims pressured through ransom notes and threats to publish data on Tor-based leak sites. Investigations and technical analyses showed the operators commonly gained initial access through compromised or brute-forced **RDP** credentials and phishing, then expanded access with reconnaissance and post-exploitation tools including **Advanced IP Scanner**, **Advanced Port Scanner**, **PowerShell Empire**, **Koadic**, **Mimikatz**, **PsExec**, **Cobalt Strike**, **WinSCP**, **Chisel**, and **MEGA**. The malware appended extensions such as `.pysa`, `.locked`, and `.newversion`, used AES encryption with RSA-protected keys, terminated services and security tools to improve encryption success, and in some cases changed local account passwords or modified Windows legal notice settings to display ransom demands. Researchers and law enforcement said the campaign disproportionately targeted high-value organizations, especially education, healthcare, and government entities, and urged mitigations including MFA, RDP hardening, segmentation, patching, least privilege, backups, and user awareness training.
Aug 15, 2026
Royal ransomware emerged as a major threat after first being observed in September 2022, with intrusions linked to likely Russian-speaking cybercrime actors and possible overlap with former **Conti** members. The group has hit organizations globally, including multiple Australian victims and critical infrastructure, with a concentration of cases in the United States and Canada across healthcare, manufacturing, education, and government. Royal operators steal data before encrypting systems, then pressure victims through leak-site exposure and, in some cases, social media harassment; reported ransom demands have reached **$25 million** in bitcoin. Analysts also identified infrastructure and tooling overlaps between Royal activity, **FRwL / UAC-0118**, and earlier ex-Conti-linked operations, including shared IPs and a **Cobalt Strike** watermark associated with related campaigns. Investigations show Royal gains initial access through callback phishing, SEO poisoning, malicious downloads, phishing links sent via website contact forms, exploitation of unpatched vulnerabilities, exposed **RDP**, and compromised credentials. After entry, the actors have used **BATLOADER**, **Qakbot**, **Bokbot**, **Cobalt Strike**, **PsExec**, **PowerShell**, **AdFind**, **NetScan**, **Chisel**, **Rclone**, **PCHunter**, **PowerTool**, and **Process Hacker** to move laterally, evade defenses, exfiltrate data, and deploy ransomware on Windows as well as a Linux/**ESXi** ELF variant. Royal typically encrypts local drives and network shares, appends the `.royal` extension, deletes shadow copies, disables security services, and leaves `README.txt` ransom notes with Tor-based contact instructions. Defenders are urged to prioritize **software patching**, multifactor authentication, network segmentation, traffic filtering, application allowlisting, privileged account controls, and offline encrypted backups to reduce exposure to the exploitation and credential abuse techniques seen in Royal intrusions.
Aug 15, 2026