Vice Society Group Switches Malware, Targets Educational Institutes

The latest findings

• The ransomware group has been juggling between payloads such as BlackCat, QuantumLocker, Zeppelin, and a Vice Society-branded variant of Zeppelin ransomware. It has been observed in attacks with HelloKitty/Five Hands ransomware as well.
• Since September, Vice Society has shifted to a modified version of its payload dubbed RedAlert that adds the .locked file extension to encrypted documents. 

Tools and malware used

• Vice Society’s attacks included custom PowerShell scripts and commodity backdoors such as SystemBC and PortStarter.
• It further used commodity tools named Advanced Port Scanner and Advanced IP Scanner. 
• Other additional tools include WMIC, Impacket’s WMIexec, Impacket Atexec, Vssadmin, Mimikatz, PsExec, and legitimate data sync tools such as Rclone and MegaSync for data exfiltration.

Attack strategy

• It gathers privileged credentials, moves laterally using RDP, collects and exfiltrates data, gains post-compromise elevation of privilege, and deploys ransomware.
• In some cases, the group did not deploy ransomware and instead possibly performed extortion using only exfiltrated stolen data.
• In other cases, it exfiltrates data from compromised systems before encryption and uses it for double extortion, threatening victims to leak it online if the ransom is not paid.

Conclusion