Loading malware…
Vice Society is a human-operated double-extortion ransomware operation first identified in 2021 and widely associated with intrusions against education and healthcare organizations, while also affecting manufacturing and other enterprise sectors. The group has been tracked by some vendors as Gold Victor and has been observed both deploying third-party ransomware families such as HelloKitty/Five Hands, Zeppelin, RedAlert, and later using a custom ransomware variant referred to as PolyVice. Reporting has also described possible operational overlap or affiliate migration between Vice Society and Rhysida, although a definitive full rebrand has not been conclusively established.
Vice Society campaigns typically involve hands-on-keyboard post-compromise activity in enterprise Windows environments. Observed tradecraft includes abuse of compromised remote access, exploitation of vulnerabilities such as PrintNightmare for lateral movement, credential theft using tools such as Mimikatz and Active Directory database dumping, network discovery, remote administration, and data exfiltration prior to encryption. The operation has used PowerShell automation for exfiltration and system preparation, disabled security controls, deleted shadow copies, terminated security and business-critical processes, cleared event logs, and created or modified administrator access for persistence and continued control. Multiple reports also associate Vice Society activity with RDP-centric lateral movement and use of common offensive tooling including Cobalt Strike, Rubeus, AnyDesk, PsExec, and proxy or backdoor utilities such as SystemBC and PortStarter in related affiliate activity.
The operation is known for double extortion: stealing victim data and threatening publication if ransom demands are not met. Victim targeting has shown a notable concentration in schools, universities, and healthcare entities, including attacks that disrupted public-sector and critical service organizations. Vice Society has also been linked to attacks affecting virtualized infrastructure, including Hyper-V environments. The group’s evolution from reusing established ransomware payloads toward custom tooling indicates increasing technical maturity and adaptability within the broader ransomware ecosystem.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Группа вымогателей Vice Society теперь активно использует уязвимость PrintNightmare (CVE-2021-1675 и CVE-2021-34527) диспетчера очереди печати Windows для бокового перемещения по сетям своих жертв. | Название: Vice Society. Вероятно спин-офф от HelloKitty ... Группа вымогателей Vice Society теперь активно использует уязвимость PrintNightmare (CVE-2021-1675 и CVE-2021-34527).
The situation began in June with CVE-2021-1675 ... There was confusion when researchers published a proof-of-concept (PoC) called “PrintNightmare,” stating it was for CVE-2021-1675 when it was actually a distinct vulnerability.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Название: Vice Society. Вероятно спин-офф от HelloKitty ... Группа вымогателей Vice Society теперь активно использует уязвимость PrintNightmare (CVE-2021-1675 и CVE-2021-34527).
Secureworks calls that group Gold Victor and it operated a ransomware scheme called Vice Society.
"...we identified a ransomware affiliate group move from deploying Vice Society to leveraging Rhysida ransomware in attacks against enterprises."
6 distinct techniques documented for this family, organized by ATT&CK tactic.
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ransomware group known for targeting organizations with human-operated campaigns, exploiting vulnerabilities in unsupported or unpatched Windows systems.
Ransomware strain used in extortion operations.
Ransomware group/family discussed as possibly rebranding to Rhysida after targeting healthcare and education organizations.
Vice Society is a ransomware scheme previously operated by the group Secureworks tracks as Gold Victor, which the article says later rebranded as Rhysida.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.