Ransomwarecritical
Vice Society: Profiling a Persistent Threat to the Education Sector
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-34527 | PrintNightmare: Remote Code Execution in Microsoft Windows Print Spooler | 8.8 | 100% | KEVRansomwarePoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | file.io | orage and transfer services such as Mega.nz, Anonfiles.com, File.io, and Sendspace have been used by Vice Society to exfiltrate |
| domain | onionmail.org | tor vary between samples, but the public v-society.official@onionmail[.]org address and the Tor .onion link remain consistent. Figure |
| domain | ssq4zimieeanazkzc5ld4v5hdibi2nzwzdibfh5n5w4pw5mcik76lzyd.onion | inactive, while the following site mirror was still active: ssq4zimieeanazkzc5ld4v5hdibi2nzwzdibfh5n5w4pw5mcik76lzyd[.]onion Recently, the header for the group’s blog site bears a st |
| domain | vsociethok6sbprvevl4dlwbqrzyhxcxaqpvcqt5belwvsuxaxsutyad.onion | ites on the Tor network using the following .onion address: vsociethok6sbprvevl4dlwbqrzyhxcxaqpvcqt5belwvsuxaxsutyad[.]onion On Oct. 20, the primary .onion address became inactive, w |
| md5 | 8acb34bed3caa60cae3f08f75d53f727 | files Creating a file called README.txt.v-society Imphash: 8acb34bed3caa60cae3f08f75d53f727 Creating a temp file with a .Zeppelin extension using the f |
From the original article
13 min read at unit42.paloaltonetworks.com
Vice Society is a ransomware gang that has been involved in high-profile activity against schools this year. Unlike many other ransomware groups such as LockBit that follow a typical ransomware-as-a-service (RaaS) model, Vice Society’s operations are different in that they’ve been known for using forks of pre-existing ransomware families in their attack chain that are sold on DarkWeb marketplaces.
By JR Gumarin · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.