SYMBOLCOMMON_NAMEaka. SYNONYMS

Vanilla Tempest  (Back to overview)

aka: DEV-0832, Vice Society

Vice Society is a ransomware group that has been active since at least June 2021. They primarily target the education and healthcare sectors, but have also been observed targeting the manufacturing industry. The group has used multiple ransomware families and has been known to utilize PowerShell scripts for their attacks. There are similarities between Vice Society and the Rhysida ransomware group, suggesting a potential connection or rebranding.

Associated Families

There are currently no families associated with this actor.

References
2023-12-12 ⋅ Fourcore ⋅ Swapnil
Rhysida Ransomware: History, TTPs And Adversary Emulation Plans
Rhysida Rhysida Vanilla Tempest
2023-12-10 ⋅ Detect FYI ⋅ Simone Kraus
Rhysida Ransomware and the Detection Opportunities
PolyVice Rhysida Vanilla Tempest
2023-08-08 ⋅ Checkpoint ⋅ Checkpoint Research
THE RHYSIDA RANSOMWARE: ACTIVITY ANALYSIS AND TIES TO VICE SOCIETY
Rhysida Vanilla Tempest
2022-10-25 ⋅ Microsoft ⋅ Microsoft Security Threat Intelligence
DEV-0832 (Vice Society) opportunistic ransomware campaigns impacting US education sector
BlackCat Mount Locker PortStarter Zeppelin Vanilla Tempest
Credits: MISP Project