#StopRansomware: Vice Society

guest · Sep 6, 2022

September 6, 2022

CISA, the Federal Bureau of Investigation (FBI), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) have released a joint Cybersecurity Advisory (CSA), #StopRansomware: Vice Society, to disseminate tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) associated with Vice Society actors identified through FBI investigations as recently as September 2022. Vice Society uses ransomware attacks against the education sector to gain access to, and threaten exposure of, sensitive personal information regarding students and staff for financial gain.

CISA encourages organizations to review #StopRansomware: Vice Society for more information. Additionally, see StopRansomware.gov for guidance on ransomware protection, detection, and response.
Click to expand...

Alert (AA22-249A)

Over the past several years, the education sector, especially kindergarten through twelfth grade (K-12) institutions, have been a frequent target of ransomware attacks. Impacts from these attacks have ranged from restricted access to networks and data, delayed exams, canceled school days, and unauthorized access to and theft of personal information regarding students and staff.

The FBI, CISA, and the MS-ISAC anticipate attacks may increase as the 2022/2023 school year begins and criminal ransomware groups perceive opportunities for successful attacks. School districts with limited cybersecurity capabilities and constrained resources are often the most vulnerable; however, the opportunistic targeting often seen with cyber criminals can still put school districts with robust cybersecurity programs at risk. K-12 institutions may be seen as particularly lucrative targets due to the amount of sensitive student data accessible through school systems or their managed service providers.
Click to expand...

The FBI, CISA, and the MS-ISAC encourage organizations to implement the recommendations in the Mitigations section of this CSA to reduce the likelihood and impact of ransomware incidents.
Click to expand...

guest · Dec 31, 2022

Vice Society Ransomware Attackers Adopt Robust Encryption Methods
By Ravie Lakshmanan - December 23, 2022

The Vice Society ransomware actors have switched to yet another custom ransomware payload in their recent attacks aimed at a variety of sectors.

"This ransomware variant, dubbed 'PolyVice,' implements a robust encryption scheme, using NTRUEncrypt and ChaCha20-Poly1305 algorithms," SentinelOne researcher Antonio Cocomazzi said in an analysis.
Vice Society, which is tracked by Microsoft under the moniker DEV-0832, is an intrusion, exfiltration, and extortion hacking group that first appeared on the threat landscape in May 2021.

Unlike other ransomware gangs, the cybercrime actor does not use file-encrypting malware developed in-house. Instead, it's known to deploy third-party lockers such as Hello Kitty, Zeppelin, and RedAlert ransomware in their attacks.
Click to expand...

The shift from Zeppelin is likely to have been spurred by the discovery of weaknesses in its encryption algorithm that enabled researchers at cybersecurity company Unit221B to devise a decryptor in February 2020.

Besides implementing a hybrid encryption scheme that combines asymmetric and symmetric encryption to securely encrypt files, PolyVice also makes use of partial encryption and multi-threading to speed up the process.
Click to expand...

SentinelOne: Custom-Branded Ransomware: The Vice Society Group and the Threat of Outsourced Development

By Antonio Cocomazzi @splinter_code - December 22, 2022
Executive Summary

The Vice Society group has adopted a new custom-branded ransomware payload in recent intrusions

This ransomware variant, dubbed “PolyVice”, implements a robust encryption scheme, using NTRUEncrypt and ChaCha20-Poly1305 algorithms

We assess it is likely that the group behind the custom-branded ransomware for Vice Society is also selling similar payloads to other groups

Click to expand...

guest · Jan 28, 2023

5 facts about Vice Society, the ransomware group wreaking havoc on the education sector
By Bill Cozens - January 26, 2023

[...] there's a new ransomware-as-a-service (RaaS) player in town attacking the education sector—and its name is Vice Society.
Vice Society is believed to be a Russian-based intrusion, exfiltration, and extortion group. And their ideal prey? You guessed it: universities, colleges, and K-12 schools. The Federal Bureau of Investigation (FBI) has even released a joint Cybersecurity Advisory (CSA) after observing that Vice Society has disproportionately targeted the education sector.
But with knowledge comes power. The more the education sector knows about Vice Society, the better prepared they get to defend against them.

In this article, we’ll arm you with five facts about Vice Society so you can get the upper-hand against this persistent threat.
Click to expand...

Log in or Sign up

#StopRansomware: Vice Society

guest Guest

guest Guest

guest Guest

Log in or Sign up

#StopRansomware: Vice Society

guest Guest

guest Guest

guest Guest

Useful Searches