Vice Society: Profiling a Persistent Threat to the Education Sector
Summary: Vice Society, a ransomware group active since summer 2021, uses forks of existing ransomware families such as HelloKitty and Zeppelin rather than a custom payload, and a September 2022 joint advisory from the FBI, CISA and MS-ISAC said the group was disproportionately targeting the education sector. Unit 42 estimates Vice Society has impacted more than 100 organizations since 2021, with more than 90 of the published leak site infections occurring in 2022 and at least 33 educational institutions listed on its leak site.
Key Takeaway: Unit 42 incident response cases recorded dwell times of up to six days between initial compromise and discovery, and the group gives victims seven days to meet ransom demands while exfiltrating data for double extortion. With at least 33 schools listed on the leak site and campaigns timed to the U.S. school year, K-12 districts running unpatched legacy hardware and managing student and staff personal devices are the targets of opportunity.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Ransomware
- Mentions
- CVE-2021-34527
- Related
- CVE-2021-34527: Microsoft Windows Print Spooler Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021