Vice Society Ransomware Attackers Adopt Robust Encryption Methods

Dec 23, 2022Ravie LakshmananRansomware / Endpoint Security

The Vice Society ransomware actors have switched to yet another
custom ransomware payload in their recent attacks aimed at a
variety of sectors.

“This ransomware variant, dubbed ‘PolyVice,’ implements a
robust encryption scheme, using NTRUEncrypt^[1]
and ChaCha20-Poly1305^[2]
algorithms,” SentinelOne researcher Antonio Cocomazzi said^[3]
in an analysis.

Vice Society^[4], which is tracked by
Microsoft under the moniker DEV-0832, is an intrusion,
exfiltration, and extortion hacking group that first appeared on
the threat landscape in May 2021.

Unlike other ransomware gangs, the cybercrime actor does not use
file-encrypting malware developed in-house. Instead, it’s known to
deploy third-party lockers such as Hello Kitty, Zeppelin, and
RedAlert ransomware in their attacks.

Per SentinelOne, indications are that the threat actor behind
the custom-branded ransomware is also selling similar payloads to
other hacking crews based on PolyVice’s extensive similarities to
ransomware strains Chily and SunnyDay.

This implies a “Locker-as-a-Service” that’s offered by an
unknown threat actor in the form of a builder that allows its
buyers to customize their payloads, including the encrypted file
extension, ransom note file name, ransom note content, and the
wallpaper text, among others.

The shift from Zeppelin is likely to have been spurred by the
discovery of weaknesses^[5]
in its encryption algorithm that enabled researchers at
cybersecurity company Unit221b to devise a decryptor in February
2020.

Besides implementing a hybrid encryption scheme that combines
asymmetric and symmetric encryption to securely encrypt files,
PolyVice also makes use of partial encryption and multi-threading
to speed up the process.

It’s worth pointing out that the recently discovered Royal
ransomware employs^[6]
similar tactics in a bid to evade anti-malware defenses, Cybereason
disclosed last week.

Royal^[7], which has its roots in
the now-defunct Conti ransomware^[8]
operation, has also been observed to utilize call back phishing^[9]
(or telephone-oriented attack delivery) to trick victims into
installing remote desktop software for initial access.

In the meanwhile, the leak of Conti source code earlier this
year has spawned a number of new ransomware strains such as Putin
Team, ScareCrow, BlueSky^[10], and Meow, Cyble
disclosed^[11], highlighting how such
leaks are making it easier for threat actors to launch different
offshoots with minimum investment.

“The ransomware ecosystem is constantly evolving, with the trend
of hyperspecialization and outsourcing continuously growing,”
Cocomazzi said, adding it “presents a significant threat to
organizations as it enables the proliferation of sophisticated
ransomware attacks.”