Vice Society Ransomware Attackers Targeted Dozens of Schools in 2022

Dec 07, 2022Ravie LakshmananCyber Crime / Ransomware

The Vice Society cybercrime group has disproportionately
targeted educational institutions, accounting for 33 victims in
2022 and surpassing other ransomware families like LockBit,
BlackCat, BianLian, and Hive.

Other prominent industry verticals targeted include healthcare,
governments, manufacturing, retail, and legal services, according
to an analysis of leak site data^[1] by Palo Alto Networks
Unit 42.

The cybersecurity company called Vice Society one of the “most
impactful ransomware gangs of 2022.”

Of the 100 organizations impacted in total, 35 cases have been
reported from the U.S., followed by 18 in the U.K., seven in Spain,
six each in Brazil and France, four each in Germany and Italy, and
three cases in Australia.

Active since May 2021, Vice Society stands apart from other
ransomware crews in that it does not use a ransomware variant of
its own, rather relying on pre-existing ransomware binaries such as
HelloKitty and Zeppelin that are sold on underground forums.

Microsoft, which is tracking the activity under the name
DEV-0832^[2], said the group avoids
deploying ransomware in some cases and carries out extortion using
exfiltrated stolen data.

The operators have been observed^[3]
obtaining initial network access through compromised credentials by
leveraging internet-facing applications, in addition to abusing
known security flaws to escalate privileges.

Unit 42’s incident response efforts show that the group has a
dwell time of six days in the victims’ environments and that the
initial ransom amounts could exceed $1 million – a figure that may
drop by as much as 60% post negotiations to $460,000.

“School districts with limited cybersecurity capabilities and
constrained resources are often the most vulnerable to threat
actors,” Unit 42 researcher JR Gumarin said.

“Vice Society and its consistent targeting of the education
industry vertical, particularly around the September time frame,
serves as a warning that this group has shaped their campaigns to
take advantage of the school year in the U.S.”