Vice Society was the ransomware and data extortion group that hit schools, colleges and universities harder than any other crew in 2022, and its playbook still shows up under other payload names. This profile covers the group from its first sighting in June 2021 to the point where vendor research tied its operators to Rhysida in 2023. It sets out how the group got in, how it used stolen administrator credentials, how it stole data and what defenders can watch for at each stage. It is written for security teams in education, local government and healthcare, and for threat intelligence analysts who need a group level view. Attribution here comes only from vendor primary research, and the profile does not name individuals.
Key takeaways
- Education was the main target. Palo Alto Networks Unit 42 counted at least 33 educational institutions on the Vice Society leak site in 2022, more than any other ransomware group that year, with activity peaking around the start of the school year.
- The payload changed, the playbook did not. The group used HelloKitty, Zeppelin, BlackCat, Quantum Locker, RedAlert and its own branded variants, and sometimes skipped encryption altogether in favour of data theft extortion.
- Domain admin was the turning point. Microsoft observed LSASS dumping, NTDS.dit theft, Kerberoasting and, in one case, password resets for more than 150,000 users through two domain admin accounts to hinder recovery.
- Exfiltration was broad and scripted. PowerShell scripts run from a domain controller share collected files by keyword and pushed them out over HTTP POST or to cloud storage, which leaves clear traces in PowerShell logging and egress data.
- The operators reportedly moved on to Rhysida. Check Point assessed with at least medium confidence that Vice Society operators began using Rhysida in 2023, and Microsoft now tracks the actor as Vanilla Tempest, so defences built for Vice Society still apply.
Who they are (names and aliases)
Vice Society is a financially motivated group, active since at least June 2021 according to Microsoft. Unit 42 notes that researchers first reported HelloKitty payloads appending a .v-society extension on 10 June 2021. Unlike many crews that build or lease one ransomware brand, Vice Society bought or borrowed existing payloads and ran a double extortion leak site under its own name. The group has no MITRE ATT&CK group entry at the time of writing, so map its behaviour to individual techniques rather than to a group ID.
| Name | Used by | Notes |
|---|---|---|
| Vice Society | The group itself, most vendors, press | Leak site brand and ransom note name; the leak site imitated the styling of a well-known video game |
| DEV-0832 | Microsoft (2022) | Temporary designation used in the October 2022 Microsoft report |
| Vanilla Tempest | Microsoft (from April 2023) | Renamed under Microsoft's weather themed naming taxonomy; later reporting on Vanilla Tempest covers Rhysida and INC payloads |
| Twinkling Scorpius | Palo Alto Networks Unit 42 | Unit 42 constellation name for the group |
The relationship with Rhysida is covered in more depth in the Rhysida Ransomware Profile Guide; this page focuses on the 2021 to 2023 Vice Society period and what it teaches defenders.
Targeting and motivation
Vice Society chose targets of opportunity: organisations with thin security teams, legacy systems and a higher chance of paying. Microsoft described campaigns from July to October 2022 that heavily affected the United States education sector, after earlier opportunistic attacks on local government and retail. Unit 42 lists education (K-12 and higher education) first, followed by healthcare, non-profit organisations, state and local government and manufacturing, mostly small and medium sized organisations.
- Geography: Unit 42 found victims in every region, with the United States (35 cases), the United Kingdom (18) and Spain (7) at the top of its leak site sample.
- Volume: Unit 42 estimated more than 100 victims since 2021, with more than 90 posted in 2022 alone.
- Timing: leak site postings spiked in spring 2022 and again in autumn 2022 as the school year began. A joint CISA, FBI and MS-ISAC advisory in September 2022 warned of disproportionate targeting of education, as Unit 42 also records.
- Money: Unit 42 reported initial demands above US$1 million, final demands as high as US$460,000, and reductions of up to 60% after negotiation. Victims were typically given around seven days on the leak site before publication.
- Notable victim: Check Point lists the Los Angeles Unified School District among the group's attacks.
The education focus matters because schools combine large, loosely managed identity populations (staff, students, contractors), flat networks and sensitive records about minors. The Top 10 Education Cyber Threats and the Education Sector Cyber Statistics pages cover the wider sector picture.
Payloads and tooling
Vice Society's tool set changed every few months, which is why indicator based blocking alone failed against it. The table lists payloads and tools named in the vendor research.
| Payload or tool | Role | Source and notes |
|---|---|---|
| HelloKitty (FiveHands) | Ransomware, Windows and Linux | Unit 42: used in 2021, files renamed with .v-society.<victim ID> |
| Zeppelin and a Vice Society branded variant | Ransomware, Windows | Unit 42 and Microsoft: extensions .v-s0ciety, .v-society, later .locked |
| BlackCat, Quantum Locker | Commodity ransomware | Microsoft, 2022 intrusions |
| RedAlert variant | Ransomware | Microsoft: seen late September 2022, .locked extension |
| Linux encryptor | Ransomware for VMware ESXi | Microsoft: deployed on an ESXi server |
| SystemBC | Remote access tool and proxy | Microsoft and Unit 42; Check Point saw a firewall rule named "Windows Update" relaying its traffic and a Run key named "socks" |
| PortStarter | Go backdoor that changes firewall settings and opens ports to command and control | Microsoft; Check Point later found samples on Rhysida infrastructure |
| PsExec, WMIC, Impacket, Power Admin, vssadmin | Legitimate admin tools used for execution, spread and shadow copy deletion | Microsoft |
| Advanced Port Scanner, Advanced IP Scanner, BloodHound | Discovery | Microsoft and Unit 42 |
| PowerShell exfiltration scripts, Rclone, MegaSync | Data theft | Microsoft (Rclone and MegaSync suspected) and Unit 42 |
Microsoft also reported intrusions where no ransomware ran at all and the group relied only on stolen data. Plan for that case: a quiet network with no encrypted files does not mean there was no extortion event. See the Data Exfiltration Guide.
Tactics and techniques (MITRE ATT&CK)
The mapping below uses ATT&CK v20 technique IDs for behaviour described by Microsoft, Unit 42 and Check Point. It is a defender's summary at technique level, with the telemetry that best shows each step.
| Phase | Technique (ATT&CK v20) | Reported behaviour | Telemetry to use |
|---|---|---|---|
| Initial access | T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1566 Phishing | Compromised accounts, vulnerable web-facing applications and phishing (Microsoft notes access vectors were reported rather than confirmed) | VPN and remote access logs, identity provider sign-ins, web server and WAF logs |
| Execution | T1059.001 PowerShell; T1047 Windows Management Instrumentation; T1569.002 Service Execution | PowerShell scripts staged on domain controllers; PsExec and WMIC for remote launch | Event 4104 script block logging, 4688 or Sysmon 1 process creation, 7045 new service |
| Persistence | T1136 Create Account; T1547.001 Registry Run Keys; T1053.005 Scheduled Task | New accounts named to look like admin accounts; Run keys and scheduled tasks for backdoors | Event 4720 and 4728 or 4732 group adds, registry and task creation telemetry |
| Privilege escalation | T1068 Exploitation for Privilege Escalation | CVE-2022-24521 (Windows CLFS) and PrintNightmare (CVE-2021-1675, CVE-2021-34527), all in the CISA KEV catalogue with known ransomware use | Patch state, print spooler service status on servers and domain controllers |
| Defence impairment | T1685 Disable or Modify Tools; T1686 Disable or Modify System Firewall; T1112 Modify Registry | Registry changes to turn off Microsoft Defender Antivirus; firewall rules opened for PortStarter and SystemBC | Tamper protection alerts, Defender event 5001, firewall rule change events |
| Credential access | T1003.001 LSASS Memory; T1003.003 NTDS; T1558.003 Kerberoasting | LSASS dumps via comsvcs.dll MiniDump; NTDS.dit copies via ntdsutil; Invoke-Kerberoast | LSASS access alerts, ntdsutil process creation on DCs, event 4769 with RC4 tickets |
| Discovery | T1046 Network Service Discovery | Advanced Port Scanner, Advanced IP Scanner, BloodHound | Internal scan detection, LDAP query volume |
| Lateral movement | T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares | RDP between hosts; SMB shares holding scripts and ransomware | Event 4624 logon types 3 and 10 from unusual sources, admin share access |
| Collection and exfiltration | T1560 Archive Collected Data; T1020 Automated Exfiltration; T1567.002 Exfiltration to Cloud Storage; T1048 Exfiltration Over Alternative Protocol | Keyword driven scripts, compression tools, uploads to cloud storage services and HTTP POST to attacker servers | Proxy and firewall egress volume, POSTs to raw IP addresses, cloud storage domains |
| Command and control | T1090 Proxy; T1105 Ingress Tool Transfer | SystemBC proxying, tools copied in from attacker infrastructure | Outbound connections on unusual ports, new firewall allow rules |
| Impact | T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery; T1531 Account Access Removal | Encryption of Windows and ESXi hosts; deletion of shadow copies, backups and databases; mass password resets | vssadmin and backup console events, sudden volume of 4724 password resets |
Event IDs in the telemetry column are standard Windows Security, System and PowerShell log events; confirm they are collected before relying on them.
How they abuse identities and credentials
Every Vice Society intrusion described by Microsoft ran through Active Directory. Once the group had a foothold, it went for credential stores and privileged accounts, then used them to spread and to block recovery.
- Credential theft at scale: LSASS dumps with a built-in Windows DLL rather than a known hacking tool, NTDS.dit copies from domain controllers and Kerberoasting of service accounts. Weak service account passwords turn Kerberoasting into domain compromise. See the Kerberoasting and AS-REP Roasting Defence Guide and the Credential Dumping Guide.
- Look-alike admin accounts: Microsoft saw new accounts created to resemble existing administrator accounts. A periodic diff of privileged group membership against an approved list catches this quickly.
- Admin shares as a launch pad: Unit 42 describes the exfiltration script being run from a domain controller's administrative share with the execution policy bypassed, so any endpoint could run it without arguments.
- Identity as a weapon at the end: using two domain admin accounts, the group reset passwords for more than 150,000 users in one intrusion. Check Point later reported domain-wide password changes before deployment in Rhysida cases too. Recovery plans need an out-of-band way to regain domain control, such as offline break glass accounts and a tested forest recovery procedure.
The common thread is standing privilege: service accounts with old passwords, administrators who log on to ordinary workstations and domain admin rights used for daily work. Tiering and isolating privileged identities removes the shortcuts Vice Society relied on. See Active Directory Tiering vs Red Forest.
Notable activity and the Rhysida link
- June 2021: first HelloKitty payloads with the
.v-societyextension reported (Unit 42). - 2022: the group's busiest year, with more than 90 leak site posts and at least 33 education victims (Unit 42). Microsoft's October 2022 report covered campaigns from July to October against US education.
- Early 2023: Unit 42 incident responders found a new PowerShell exfiltration script with job batching and concurrency limits designed to keep resource use low and avoid notice.
- April 2023: Microsoft renamed DEV-0832 to Vanilla Tempest.
- May to August 2023: Rhysida appeared in May 2023. Vice Society's last leak site post was on 21 June 2023, and in August 2023 Check Point assessed with at least medium confidence that Vice Society operators had moved to Rhysida, citing a shared NTDS staging folder name, the same SystemBC firewall rule and Run key names, domain-wide password changes and PortStarter samples on Rhysida infrastructure. Check Point also stresses that Rhysida is not used only by this group.
The practical point from Check Point's analysis is that the behaviour of a prolific group changes far less than its payload. Detection built on Vice Society behaviour also covered the early Rhysida intrusions. For the later Vanilla Tempest period, including reported GootLoader initial access and INC payloads, see the GootLoader Malware Guide and the INC Ransom and Lynx Ransomware Profile Guide.
Detection and defence
The controls that would have broken Vice Society intrusions are mostly identity and endpoint hardening that education and public sector teams can afford. Order them by where they stop the chain earliest.
Controls mapped to the attack chain
| Stage | Control | Specific setting or check |
|---|---|---|
| Initial access | Phishing-resistant MFA on VPN, remote desktop gateways and webmail | No single factor exceptions for staff or contractor remote access; review legacy authentication |
| Privilege escalation | Patch KEV listed Windows flaws first | CVE-2022-24521, CVE-2021-1675, CVE-2021-34527; disable the Print Spooler service on domain controllers and servers that do not print |
| Defence impairment | Protect the security agent | Microsoft recommends tamper protection, cloud-delivered protection and EDR in block mode |
| Credential access | LSA protection | HKLM\SYSTEM\CurrentControlSet\Control\Lsa RunAsPPL = 1 (UEFI lock) or 2, or the Group Policy "Configures LSASS to run as a protected process"; check WinInit event 12 after restart |
| Credential access | ASR rule "Block credential stealing from the Windows local security authority subsystem" | GUID 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2; Microsoft notes the audit volume is high and the rule can move straight to block on a pilot group |
| Execution and spread | ASR rule "Block process creations originating from PSExec and WMI commands" | GUID d1e49aac-8f56-4280-b9ba-993a6d77406c; Microsoft warns not to enable it on Configuration Manager managed devices because the client relies on WMI |
| Impact | ASR rule "Use advanced protection against ransomware" | GUID c1db55ab-c21a-4637-bb3f-a12568109d35 |
| Lateral movement | Block SMB and RPC between workstations | Host firewall rules that allow SMB only to file servers and management hosts |
| Recovery | Immutable, separately administered backups | Backup consoles not joined to the production domain; offline copy of domain controller system state |
Hunting for the playbook
- PowerShell from admin shares: alert on PowerShell command lines that load scripts from a remote administrative share with the execution policy bypassed, and collect events 4103 and 4104 centrally, as Unit 42 recommends. See the PowerShell Security Guide.
- Exfiltration shape: HTTP POSTs with no user agent to raw IP addresses, and upload spikes from servers or privileged accounts that rarely send data out.
- Domain controller activity: ntdsutil runs, shadow copy creation or deletion and new firewall rules on DCs outside change windows.
- Account changes: new accounts with names close to existing admin names, and any burst of password resets by a single account.
- Vendor detections: Microsoft lists Ransom:Win32/VSocCrypt, Trojan:PowerShell/VSocCrypt, Ransom:Linux/ViceSociety and Backdoor:Win64/PortStarter among its Defender detection names for this activity.
Rolling out the hardening
- Week 1: inventory remote access paths and confirm MFA coverage; patch the KEV CVEs above; disable Print Spooler on domain controllers.
- Weeks 2 to 4: turn on PowerShell script block logging and forward 4103, 4104, 4688, 4720, 4724 and 4769 to the SIEM; baseline egress volume per server.
- Weeks 4 to 8: enable LSA protection in audit mode (CodeIntegrity events 3065 and 3066), fix incompatible plug-ins, then enforce on a pilot ring and expand. Roll back by setting RunAsPPL to 0 where no UEFI lock was used.
- Weeks 6 to 10: deploy the ASR rules in audit mode, review blocks against legitimate admin tooling, then move to block ring by ring.
- Quarter 1: reset Kerberoastable service account passwords to long random values or move them to managed service accounts; separate admin accounts from daily accounts; test a domain recovery from offline backups.
Measuring progress
- Percentage of remote access sign-ins protected by phishing-resistant MFA.
- Percentage of Windows endpoints and servers with LSA protection enforced (WinInit event 12 present).
- Number of service accounts with SPNs and passwords older than one year.
- Coverage of PowerShell script block logging across servers and domain controllers.
- Time to restore a domain controller and a core student information system from backup in the last test.
Framework mapping
| Defence area | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | CIS Controls v8.1 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|---|
| Threat intelligence on actors targeting the sector | ID.RA-03 | SI-4 | 17 (incident response) | A.5.7 |
| MFA on remote access | PR.AA-03 | IA-2 | 6.4 | A.8.5 |
| Least privilege and admin account control | PR.AA-05 | AC-2, AC-6 | 5.4, 6.8 | A.8.2 |
| Restricting admin tools and lateral paths | PR.AA-05 | CM-7, SC-7 | 4.4, 12 | A.8.20 |
| Logging and monitoring | DE.CM-01, DE.CM-09 | AU-12, SI-4 | 8.2, 8.8 | A.8.15, A.8.16 |
| Backups and recovery | PR.DS-11, RC.RP-01 | CP-9 | 11.3, 11.4 | A.8.13 |
| Containment | RS.MI-01 | SI-4 | 17.4 | A.5.26 |
Common failure patterns
- Blocking indicators, not behaviour: hash and extension blocks for one payload did nothing when the group switched to the next one. Hunt for the admin tool and PowerShell patterns instead.
- Service accounts with old passwords: Kerberoasting only works when service account passwords can be cracked. Long random passwords or managed service accounts remove the risk.
- Backups in the same domain: the group deleted backups, shadow copies and databases. Backups administered with domain credentials fall at the same time as the domain.
- No plan for losing the directory: a mass password reset by attacker-held domain admin accounts locks out staff and students. Without offline break glass accounts and a tested forest recovery, restoration stalls.
- Assuming no encryption means no breach: data-theft-only intrusions still lead to leak site publication and notification duties. Treat unexplained large uploads as an incident.
- Quiet holidays: leak site activity rose at the start of the school year. Reduced staffing during breaks and term starts is exactly when monitoring needs cover. See the Ransomware Response and Recovery Guide.
Practitioner checklist
- Enforce phishing-resistant MFA on every VPN, remote desktop gateway and webmail account, including contractors.
- Patch CVE-2022-24521, CVE-2021-1675 and CVE-2021-34527 and turn off Print Spooler on domain controllers.
- Turn on tamper protection and EDR block mode, and alert on any change to antivirus or firewall settings on servers.
- Enforce LSA protection after an audit phase and deploy the LSASS, PsExec and WMI, and ransomware ASR rules ring by ring.
- Rotate Kerberoastable service account passwords and move suitable accounts to managed service accounts.
- Collect PowerShell 4103 and 4104 events centrally and alert on scripts launched from admin shares.
- Baseline egress per server and alert on large uploads to raw IP addresses or cloud storage services.
- Keep immutable backups under separate administration and test a domain controller restore at least yearly.
- Diff privileged group membership weekly against an approved list to catch look-alike admin accounts.
Standards and references
- Microsoft Threat Intelligence: DEV-0832 (Vice Society) opportunistic ransomware campaigns impacting US education sector
- Palo Alto Networks Unit 42: Threat Assessment, Vice Society targets the education sector
- Palo Alto Networks Unit 42: Vice Society ransomware gang's PowerShell exfiltration script
- Check Point Research: The Rhysida ransomware, activity analysis and ties to Vice Society
- Microsoft Learn: Attack surface reduction rules reference
- Microsoft Learn: Configure added LSA protection
- MITRE: ATT&CK Enterprise matrix
Related NHI Mgmt Group resources: Rhysida Ransomware Profile Guide · Cybersecurity for Schools Guide · Education Identity Security Guide · Ransomware Negotiation Guide · Cybercrime Ecosystem Guide