This episode is a CISA cybersecurity alert, AA22-249A, originally released on September 6, 2022. It is presented by the Cyber Wire Network and adapted for audio by N2K Networks. The advisory is jointly issued by CISA, the FBI, and the Multi-State Information Sharing and Analysis Center (MSISAC). The focus is on disseminating indicators of compromise and TTPs associated with Vice Society actors. Vice Society is an intrusion, exfiltration, and extortion hacking group that first appeared in summer 2021. The group disproportionately targets the education sector with ransomware attacks. Unlike many groups, Vice Society does not use a uniquely developed ransomware variant. Instead, they deploy versions of Hello Kitty, Five Hands, and Zeppelin ransomware, and may use other variants. The actors obtain initial network access and have been observed exploiting the Print Nightmare vulnerability to escalate privileges. Prior to deploying ransomware, they spend time exploring networks to increase access and exfiltrate data for double extortion. For lateral movement, Vice Society uses a variety of tools, including System BC, PowerShell Empire, and Cobalt Strike. They also employ living off the land techniques, targeting legitimate services like Windows Management Instrumentation. Over recent years, the education sector, especially K-12 institutions, has been a frequent target of ransomware. Impacts from these attacks range from restricted network access and delayed exams to canceled school days. Unauthorized access and theft of personal information are also common consequences. The episode serves as a technical and operational alert to help organizations defend against these threats.
