Threat Signal Report

Joint CyberSecurity Advisory on Vice Society (AA22-249A)

description-logo Description

On September 6th, a joint cybersecurity advisory was issued by the Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing and Analysis Center (MS-ISAC) on Vice Society ransomware group that has been active since the middle of 2021 and targets multiple industry sectors including education, healthcare, and government. The threat actor uses double extortion tactics, which victims are threatened for permanently losing encrypted files and leaking stolen data to the public should ransom payment is not made.

Why is this Significant?

This is significant because alleged Vice Society victims listed on the data leak site includes organizations in education, healthcare, and government sector, which are often exempted by other major ransomware groups. Of the last ten victims (as of September 7, 2022), more than half of them are in education and healthcare sectors.

Once the threat actor sets foot into the victim's network, it laterally moves around the network, exfiltrates valuable information, and deploys ransomware which encrypts files on the compromised machine. The stolen data will be made available to the public, which may cause damage to the reputation of the affected companies.

What is Vice Society Ransomware Group?

Vice Society is a ransomware group that has been active since at least the middle of 2021 and targets both Windows and Linux systems. What's unique about this ransomware group is that it deploys third-party ransomware to its victims instead of developing its own ransomware. Such ransomware reportedly includes HelloKitty, FiveHands and Zeppelin ransomware.

Below is a typical ransom note left behind by the Vice Society threat actor:

As the ransom note states, deployed ransomware encrypts files on the compromised machines. Before the ransomware was pushed by the threat actor, it propagates through the victim's network using tools such as SystemBC, PowerShell Empire, and Cobalt Strike, and exfiltrate confidential information. The ransom note also provides a few contact email addresses. The threat actor puts additional pressure onto the victim by stating that stolen information will be released to the public if the victim does not email the attacker within seven days. The threat actor operates its own leak site where the threat actor lists victims and releases stolen data. The alleged victims are in many countries around the globe that include but not restricted to Argentina, Australia, Australia, Beirut, Brazil, Canada, Columbia, France, French Guiana, Germany, Greece, Indonesia, India, Italy, Kuwait, Malaysia, Netherland, New Zealand, Poland, Saudi Arabia, Singapore, Spain Sweden, Switzerland Thailand, and United Kingdom, United States.

Top page of Vice Society leak site

A reported infection vector used by the Vice Society ransomware group is exploitation of vulnerabilities (CVE-2021-1675 and CVE-2021-34527) that affect Microsoft Windows Print Spooler. CVE-2021-34527 is also known as PrintNightmare, which FortiGuard Labs previously released Outbreak Alert and Threat Signal on. For more information PrintNightmare, see the Appendix for a link to "Microsoft PrintNightmare" and "#PrintNightmare Zero Day Remote Code Execution Vulnerability".

Microsoft released a patch for CVE-2021-1675 and CVE-2021-34527 in June and July 2021 respectively.

What is the Status of Coverage?
FortiGuard Labs provides the following AV signatures against known ransomware samples used by Vice Society threat actor:

  • W32/Buran.H!tr.ransom
  • W32/Filecoder.OJI!tr
  • ELF/Filecoder.8BB5!tr.ransom
  • W32/Generic.AC.171!tr

FortiGuard Labs has the following IPS coverage in place for the "PrintNightmare" vulnerability (CVE-2021-34527) as well as CVE-2021-1675:

  • MS.Windows.Print.Spooler.AddPrinterDriver.Privilege.Escalation

All network IOCs are blocked by the WebFiltering client.


Traffic Light Protocol

Color When Should it Be used? How may it be shared?


Not for disclosure, restricted to participants only.
Sources may use TLP:RED when information cannot be effectively acted upon by additional parties, and could lead to impacts on a party's privacy, reputation, or operations if misused. Recipients may not share TLP:RED information with any parties outside of the specific exchange, meeting, or conversation in which it was originally disclosed. In the context of a meeting, for example, TLP:RED information is limited to those present at the meeting. In most circumstances, TLP:RED should be exchanged verbally or in person.


Limited disclosure, restricted to participants’ organizations.
Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risks to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may only share TLP:AMBER information with members of their own organization, and with clients or customers who need to know the information to protect themselves or prevent further harm. Sources are at liberty to specify additional intended limits of the sharing: these must be adhered to.


Limited disclosure, restricted to the community.
Sources may use TLP:GREEN when information is useful for the awareness of all participating organizations as well as with peers within the broader community or sector. Recipients may share TLP:GREEN information with peers and partner organizations within their sector or community, but not via publicly accessible channels. Information in this category can be circulated widely within a particular community. TLP:GREEN information may not be released outside of the community.


Disclosure is not limited.
Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.