- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Russia(high confidence)
- Sources
- 4 sources carry it
- Identifier
- GINC-APT-0615 · vanilla-tempest
RussiaWhat it is
Vice Society is a ransomware group that has been active since at least June 2021. They primarily target the education and healthcare sectors, but have also been observed targeting the manufacturing industry. The group has used multiple ransomware families and has been known to utilize PowerShell scripts for their attacks. There are similarities between Vice Society and the Rhysida ransomware group, suggesting a potential connection or rebranding.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- VICE SPIDER
- Microsoft
- DEV-0832
- Other names
- Vice Society, Vicesociety
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Tools
The tools and malware families the sources tie to it.
- POWERSOURCE
- POWERSTATS
- Power Loader
- PowerDuke
- PowerRAT
- Xploit
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de