Vice Society
Vice Society is a human-operated ransomware operation active since at least June 2021 that uses double extortion, stealing victim data and threatening to leak it in addition to encrypting systems. Reporting in the provided content links it to repeated targeting of healthcare and education organizations, with additional targeting of manufacturing and other enterprises; cited activity includes attacks in Brazil, Argentina, Switzerland, and Israel, and claimed victims such as school districts. Secureworks tracks the associated criminal operation as Gold Victor, and multiple sources discuss a possible transition or affiliate shift from Vice Society to Rhysida, although at least one source states there is not definitive proof of a full rebrand.
The content states that Vice Society initially deployed third-party ransomware payloads including Hello Kitty/Five Hands, Zeppelin, RedAlert, and others, but later developed a custom variant. Trend Micro reported a custom-built Vice Society ransomware builder and identified a sample as Ransom.Win64.VICESOCIETY.A; another report says the group created its own custom variant dubbed PolyVice in late 2022. Infection vectors and access methods mentioned in the content include exploitation of PrintNightmare, exploitation of public-facing websites, compromised RDP credentials, valid VPN credentials without MFA, phishing, and in at least one related intrusion cluster exploitation of ZeroLogon (CVE-2020-1472).
Observed tooling and behavior include Cobalt Strike, Rubeus, Mimikatz, PowerShell, PortStarter, SystemBC, PsExec, PuTTY/SSH, Advanced IP Scanner/Advanced Port Scanner, AnyDesk, 7zip, WinSCP, MegaSync, secretsdump, and ntdsutil-based dumping of ntds.dit. The content also states Vice Society actors used a custom, fully automated PowerShell data-exfiltration script. Reported actions during intrusions include disabling Windows Defender via registry changes, creating hidden administrator accounts, credential dumping, extensive RDP-based lateral movement, terminating security, backup, SQL, and business-critical processes, exfiltrating large volumes of data, deleting shadow copies with vssadmin.exe Delete Shadows /All /Quiet, clearing event logs, and deleting RDP/terminal-services traces.
Reported file and ransom-note artifacts include encrypted-file extensions .v1cesO0ciety and .vicesociety, ransom notes named AllYFilesAE and "!!! ALL YOUR FILES ARE ENCRYPTED !!!.txt", and contact emails 876505846904@onionmail[.]org, 316186524106@onionmail[.]org, and v-society.official@onionmail[.]org. One report also notes a case using a binary named svchost.exe and appending "vs_team." Virtualized environments including Microsoft Hyper-V were reported affected. Overall, the content portrays Vice Society as an adaptable ransomware threat that evolved from using leased payloads to custom ransomware while maintaining data theft, enterprise intrusion, and multi-sector extortion operations.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Vice Society, which was initially reported to be exploiting the PrintNightmare vulnerability in their routines, have previously deployed ransomware variants such as Hello Kitty/Five Hands and Zeppelin... Our detection name for this variant of Vice Society’s ransomware is Ransom.Win64.VICESOCIETY.A. | Vice Society, which was initially reported to be exploiting the PrintNightmare vulnerability in their routines...
The situation began in June with CVE-2021-1675 ... There was confusion when researchers published a proof-of-concept (PoC) called “PrintNightmare,” stating it was for CVE-2021-1675 when it was actually a distinct vulnerability.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Vice Society, which was initially reported to be exploiting the PrintNightmare vulnerability in their routines, have previously deployed ransomware variants such as Hello Kitty/Five Hands and Zeppelin... Our detection name for this variant of Vice Society’s ransomware is Ransom.Win64.VICESOCIETY.A.
Secureworks calls that group Gold Victor and it operated a ransomware scheme called Vice Society.
"...we identified a ransomware affiliate group move from deploying Vice Society to leveraging Rhysida ransomware in attacks against enterprises."
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Lateral Movement
1 technique
Lateral Movement
IOCs tracked for this family
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ransomware group known for targeting organizations with human-operated campaigns, exploiting vulnerabilities in unsupported or unpatched Windows systems.
Ransomware strain used in extortion operations.
Ransomware group/family discussed as possibly rebranding to Rhysida after targeting healthcare and education organizations.
Vice Society is a ransomware scheme previously operated by the group Secureworks tracks as Gold Victor, which the article says later rebranded as Rhysida.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.