Vanilla TempestThreat actor
- dev-0832
- Vice Society
- vice spider
Vice Society is a ransomware group that has been active since at least June 2021. They primarily target the education and healthcare sectors, but have also been observed targeting the manufacturing industry. The group has used multiple ransomware families and has been known to utilize PowerShell scripts for their attacks.From MISP Galaxy
Last reported 24 days ago, by Sophos X-Ops4 reports
ATT&CK techniques
6 of 50 · each with the sentence it comes from- T1053.005Scheduled Task
“…lish persistence through auto-run entries masquerading as legitimate Microsoft or software-update components, often reinforced with scheduled tasks.”
- T1036Masquerading
“In addition, both phases establish persistence through auto-run entries masquerading as legitimate Microsoft or software-update components, often reinforced with scheduled tasks.”
- T1547.001Registry Run Keys / Startup Folder
“…the initial JavaScript file, approximately 10-20 minutes later, two persistence mechanisms would be created leveraging Startup folder (T1547.001).”
- T1003.001LSASS Memory
“LSASS Memory - T1003.001”
- T1003.003NTDS
“Following persistence establishment, the threat actor used ntdsutil to dump the NTDS.dit database (T1003.003), then compressed it into a ZIP archive, likely staged for exfiltration.”
- T1003.006DCSync
“Subsequently, the threat actor leveraged their existing Domain Admin privileges to perform a DCSync attack.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
TerminalFix and Lorem Ipsum Loader enable covert tunneling“…apid Brigantine cybercriminal threat group, which Sophos Counter Threat Unit™ (CTU) researchers track as GOLD VICTOR (also known as Vanilla Tempest, DEV-0832, VICE SPIDER, and Vice Society).”
-
Advanced Security Solutions for SMEs: The Technology Shift“As outlined by Sekoia TDR, some attackers group today specifically target small or middle-sized companies, such as the Vice Society group or 8base and Akira ransomware groups which specialize in human-operated double-extortion campaigns.”
-
Gootloader | Threat Detection Overview“Storm-0494 then grants access from Gootloader infections to Vanilla Tempest (previously tracked as DEV-0832).”
-
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion“This technique has been previously observed by ransomware groups such as Noberus and Vice Society.”
Indicators in its reports
named in the reports above- hxxp://91.194.11[.]64/MSI.msiin 1 report
- 91.194.11[.]64in 1 report
- disk1[.]cabin 1 report
- 193.168.143[.]196in 1 report
- hxxps://cloudmeri[.]com/comm.phpin 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.