Loading story…
Vice Society disproportionately targeted educational institutions in a ransomware and extortion campaign documented by Palo Alto Networks Unit 42 in December 2022. The opportunistic group, first observed in 2021, was estimated to have affected more than 100 organizations. Its leak site listed more than 90 victims in 2022, including at least 33 educational institutions. Activity spikes potentially coincided with the beginning and end of the U.S. school year. Rather than developing custom ransomware, Vice Society used existing families, notably HelloKitty and Zeppelin.
The group's operations combined vulnerability exploitation, credential theft, lateral movement, backup targeting, data exfiltration and encryption to support double extortion. These behaviors span MITRE ATT&CK objectives including initial access, credential access, lateral movement, exfiltration and impact; the framework describes adversary goals rather than a separate incident. Unit 42 incident-response cases documented dwell times of up to six days, initial ransom demands exceeding $1 million and negotiated demands as high as $460,000. For education-sector defenders, the activity underscores the importance of timely vulnerability remediation, credential protection, lateral-movement detection and isolated, tested backups, while recognizing that recovery from encryption does not eliminate stolen-data exposure.
TTPs, infrastructure, and targeting history in one profile.
10 events from the most recent confirmed update back to the earliest known activity.
The primary leak site returned with additional sections, including Our Blog, Our Partners, For Victims and For Journalists. These sections highlighted the group's notoriety, linked leaked data and provided ransom-response guidance and FAQs.
Vice Society's primary onion leak-site address became inactive, while a mirror remained available.
The agencies issued a joint advisory stating that Vice Society disproportionately targeted the education sector. They warned that attacks could increase as the 2022–2023 school year began.
Unit 42 observed another increase in Vice Society leak-site activity involving educational institutions during fall 2022.
Vice Society's leak-site activity spiked at the end of spring 2022. Unit 42 suggested a possible relationship to school-year transitions but did not establish deliberate campaign timing.
Unit 42 identified a Linux HelloKitty sample named funny_linux.elf. Its report documents HelloKitty ELF samples featuring Vice Society ransom-note headers.
Michael Gillespie shared observations of Vice Society-linked HelloKitty ransomware payloads that appended the .v-society extension to encrypted files.
Following its early use of HelloKitty, Vice Society used Zeppelin ransomware against Windows hosts during 2021 and continued using it in 2022.
Vice Society exploited PrintNightmare during its 2021 attacks for privilege escalation and lateral movement. Unit 42 associated this exploitation with CVE-2021-34527 and CVE-2021-1675.
Unit 42's report estimated more than 100 affected organizations since 2021 and at least 33 educational institutions listed in 2022. It documented attack techniques, malware indicators and incident-response findings, including dwell times of up to six days and initial ransom demands exceeding $1 million.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 36 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FBI, CISA, and MS-ISAC issued a joint **#StopRansomware** advisory warning that the **Vice Society** intrusion and extortion group has disproportionately targeted the education sector, particularly **K-12 schools**. The group has caused network outages, delayed exams, canceled school days, and theft of student and staff personal information. Investigators said Vice Society has been active since at least summer 2021 and uses **double extortion**, stealing data before encrypting systems and threatening to publish it if victims refuse to pay. Authorities said Vice Society does not depend on a single ransomware strain, instead deploying variants including **Hello Kitty/Five Hands** and **Zeppelin**. The group has gained access through exploitation of internet-facing applications and compromised credentials, then moved laterally using tools such as **SystemBC**, **PowerShell Empire**, and **Cobalt Strike**, while escalating privileges through **PrintNightmare** flaws `CVE-2021-1675` and `CVE-2021-34527`. The advisory included indicators of compromise such as OnionMail addresses, a Tor leak site, command-and-control IP addresses, and file hashes, and urged organizations to prioritize patching known exploited vulnerabilities, enforce phishing-resistant MFA, maintain offline immutable backups, secure RDP, segment networks, and restrict SMB and other unnecessary ports.
Jun 29, 2026
U.S. authorities warned that malicious cyber actors were actively targeting K-12 schools and other educational institutions as remote learning expanded, using ransomware, malware, phishing, DDoS attacks, and video-conference intrusions to disrupt classes and steal sensitive data. The joint FBI, CISA, and MS-ISAC advisory said schools had become targets of opportunity, with ransomware incidents rising sharply and commonly involving **data theft and extortion**; families observed in attacks included `Ryuk`, `Maze`, `Nefilim`, `AKO`, and `Sodinokibi/REvil`, while malware such as `ZeuS` and `Shlayer` also affected the sector. Separate reporting on criminal forums showed underground sellers offering remote access to compromised schools and universities in the U.S., U.K., Australia, Israel, and Germany, with listings priced from **$200 to $17,000** based on victim size and privilege level. The activity coincided with leaked credentials, exposed FTP servers, and student-data incidents tied to education and e-learning platforms, reinforcing concerns about weak remote-access security, exposed `RDP` and `SMB` services, end-of-life software, and third-party edtech risks; officials urged patching, MFA, network segmentation, offline backups, DDoS protections, tighter conferencing controls, and stronger vetting of service providers.
Aug 15, 2026
U.S. and European authorities warned that the **PYSA** ransomware group, also tracked as **Mespinoza**, was conducting double-extortion attacks against education and government organizations after stealing data and then encrypting Windows and Linux systems. The FBI said incidents affected higher education, K-12 schools, and seminaries across 12 U.S. states and the United Kingdom, while France's CERT-FR reported related intrusions against local government authorities. Stolen information included employment records, personally identifiable information, and payroll tax data, with victims pressured through ransom notes and threats to publish data on Tor-based leak sites. Investigations and technical analyses showed the operators commonly gained initial access through compromised or brute-forced **RDP** credentials and phishing, then expanded access with reconnaissance and post-exploitation tools including **Advanced IP Scanner**, **Advanced Port Scanner**, **PowerShell Empire**, **Koadic**, **Mimikatz**, **PsExec**, **Cobalt Strike**, **WinSCP**, **Chisel**, and **MEGA**. The malware appended extensions such as `.pysa`, `.locked`, and `.newversion`, used AES encryption with RSA-protected keys, terminated services and security tools to improve encryption success, and in some cases changed local account passwords or modified Windows legal notice settings to display ransom demands. Researchers and law enforcement said the campaign disproportionately targeted high-value organizations, especially education, healthcare, and government entities, and urged mitigations including MFA, RDP hardening, segmentation, patching, least privilege, backups, and user awareness training.
Aug 15, 2026