Vice Society is a financially motivated organization encompassing operators and opportunistic intrusion sets known for intrusion, exfiltration and extortion against a large sample of victims since June 2021. The operator(s) of these alleged intrusion sets offer(s) an active infrastructure as new victims are constantly added to the anonymized dedicated leak site where data of the victims is exposed.<\/p>\n
The actors affiliated with Vice Society leverage not only custom Vice Society branded variants but also several ransomware-as-a-service payloads (BlackCat) as well as purchased malware (Zeppelin) for conducting attack campaigns. Sometimes, affiliates do not or cannot encrypt data, thus resorting only to the exposure of exfiltrated data for getting the ransom paid. The overall TTPs are close to those usually encountered by Russian-speaking extortion groups making headlines in recent years.<\/p>\n