|

Vice Society Ransomware

ByDetecteam

TLP

TLP CLEAR

Author

Jordi M. Lobo

Summary

The Vice Society ransomware group gained notoriety in late 2022 and early 2023 for launching attacks across various sectors, including San Francisco’s transit system. While education and healthcare were their primary targets, Trend Micro’s data reveals manufacturing industry infiltration in Brazil, Argentina, Switzerland, and Israel. Exploiting the PrintNightmare flaw initially, Vice Society progressed to self-made ransomware and potent encryption, possibly signaling their move towards a ransomware-as-a-service venture. With previous ransomware versions like Hello Kitty/Five Hands and Zeppelin, their evolving tactics showcase a versatile threat actor aiming to breach diverse industries using compromised credentials from underground sources.

DATA

windows_sysmon.xml_-1Download

TIMELINE

CATEGORY

Ransomware

references

MITRE ATT&CK

Similar Posts

  • |

    F5 Server Audit

    ByDetecteam

    TLP TLP TLP CLEAR Author Sebastien Tricaud Summary This week, we share data from an actively exploited attack from the CISA Known Exploited Vulnerabilities Catalog. This is the /var/log/audit.log file from the F5 boxes which were compromised. A critical security advisory, CVE-2023-46747, reveals an unauthenticated remote code execution vulnerability in the BIG-IP Configuration utility. This…

  • |

    Adhubllka ransomware

    ByDetecteam

    TLP TLP TLP CLEAR Author Jordi M. Lobo Summary A new ransomware variant has emerged as part of the Adhubllka ransomware family, targeting individuals and small enterprises with smaller ransom demands to evade media attention. The ransomware spreads via phishing emails and employs a victim portal on Tor for decryption key delivery after ransom payment….

  • |

    oneday SSH bruteforce

    ByDetecteam

    TLP TLP TLP CLEAR Author David Deflache Summary In this attack scenario, an individual with the IP address 192.168.0.42 and a valid username is engaging in an authentication brute force attack through SSH. Their target is a system with the IP address 192.168.0.111, using the default SSH port 22. The attacker executes a loop of…