Loading story…
SentinelOne reported that the Vice Society ransomware group used a custom-branded locker dubbed PolyVice in intrusions, indicating the group may be sourcing malware from an external specialist rather than relying solely on in-house development. The malware encrypts files across local disks, remote drives, and network shares, and uses a hybrid cryptographic design combining NTRUEncrypt to protect keys with ChaCha20-Poly1305 for per-file encryption, alongside multithreaded routines intended to speed large-scale encryption.
Researchers found code and functionality overlaps linking PolyVice to the RedAlert Linux ransomware and other custom-branded payloads associated with groups including Chily and SunnyDay. The findings point to a broader ransomware-market trend in which affiliates and intrusion groups obtain tailored lockers from third-party developers, expanding the availability of high-performance ransomware tooling across multiple threat actors.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
SentinelOne published analysis of a custom-branded ransomware variant dubbed PolyVice that had been adopted by the Vice Society group in recent intrusions. The report said code overlaps suggest the locker was likely produced by an external specialist developer also linked to RedAlert, Chily, and SunnyDay payloads.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 28 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FBI, CISA, and MS-ISAC issued a joint **#StopRansomware** advisory warning that the **Vice Society** intrusion and extortion group has disproportionately targeted the education sector, particularly **K-12 schools**. The group has caused network outages, delayed exams, canceled school days, and theft of student and staff personal information. Investigators said Vice Society has been active since at least summer 2021 and uses **double extortion**, stealing data before encrypting systems and threatening to publish it if victims refuse to pay. Authorities said Vice Society does not depend on a single ransomware strain, instead deploying variants including **Hello Kitty/Five Hands** and **Zeppelin**. The group has gained access through exploitation of internet-facing applications and compromised credentials, then moved laterally using tools such as **SystemBC**, **PowerShell Empire**, and **Cobalt Strike**, while escalating privileges through **PrintNightmare** flaws `CVE-2021-1675` and `CVE-2021-34527`. The advisory included indicators of compromise such as OnionMail addresses, a Tor leak site, command-and-control IP addresses, and file hashes, and urged organizations to prioritize patching known exploited vulnerabilities, enforce phishing-resistant MFA, maintain offline immutable backups, secure RDP, segment networks, and restrict SMB and other unnecessary ports.
Jun 29, 2026
The **Yanluowang** ransomware operation targeted U.S. organizations, with a particular focus on the financial sector, using **BazarLoader** during reconnaissance and initial compromise before expanding access through enabled RDP and remote-management tools such as **ConnectWise**. Intrusions documented by Symantec and linked reporting showed the actors conducting network discovery with tools including **AdFind** and **SoftPerfect Network Scanner**, while also deploying credential-theft and data-exfiltration utilities ahead of ransomware deployment. U.S. government reporting on **FiveHands** provides additional context for tradecraft overlaps that researchers said may indicate ties to earlier ransomware-as-a-service activity, though direct shared authorship was not confirmed. A later leak of Yanluowang internal chats, infrastructure details, and source code exposed a more structured criminal enterprise, with separate roles for development, negotiations, social engineering, pentesting, and DDoS operations. The leaked material suggested links to **Thieflock**, **PayloadBIN**, **Conti**, and references to **REvil**, while indicating the group avoided targets in former Soviet states and took steps to discuss operational security and money laundering. Researchers said the leak appears to have disrupted the gang’s operations, with onion sites reportedly going offline, but warned that publication of the ransomware source code and builder could aid both defenders and future threat actors seeking to reuse the tooling.
Aug 15, 2026
Researchers have identified **Vect** as a new ransomware-as-a-service operation advertising a purportedly custom-built C++ locker for **Windows, Linux, and VMware ESXi**. The group began recruiting affiliates on a Russian-language cybercrime forum and promotes features including **ChaCha20-Poly1305** encryption, intermittent encryption for faster impact, Safe Mode execution, SMB and WinRM propagation, GPO-based deployment, and built-in packing or crypter functionality. Vect also operates **TOR-only** infrastructure for affiliate onboarding, victim communications, and leak-site publishing, and appears to follow a **double-extortion** model. The group has publicly claimed two victims in **Brazil** and **South Africa**, although neither the intrusions nor the full malware capabilities have been independently verified. Researchers said Vect shows unusually strong operational maturity for a newly observed crew, citing Monero payments, TOX communications, and a revenue-sharing model that waives entry fees for CIS-based affiliates while charging non-CIS applicants. Reporting suggests the operators may be experienced ransomware actors or a rebrand, and defenders were urged to harden exposed **RDP/VPN** and edge appliances such as Fortinet interfaces, segment management networks, watch for Safe Mode abuse and intermittent encryption, and strengthen anti-ransomware controls.
Jul 2, 2026