Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Vice Society: A Tale of Victim Data Exfiltration via Power Shell, aka Stealing off the Land

Summary: During a 2023 incident response engagement, Unit 42 found the Vice Society ransomware gang exfiltrating victim data with a custom PowerShell script named w1.ps1, recovered from a Windows Event Log Event ID 4104 Script Block Logging entry. The script runs with -ExecutionPolicy Bypass, enumerates mounted drives via WMI, filters directories against hard-coded include and exclude lists, and sends files larger than 10 KB to the attacker's web server through HTTP POST requests, processing directories in groups of five with a cap of 10 concurrent jobs.

Key Takeaway: The script needs no arguments and decides on its own which files to take, so the gang does not have to know your environment in advance - and because it runs from a domain controller's admin share, any endpoint on the network can become a target, including machines the attacker never touched directly.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026