Vice Society Ransomware Group

Exploiting Internet-Facing Applications: Vice Society commonly targets vulnerabilities in internet-facing applications, using compromised credentials or exploiting known exploits.

Phishing: While not their primary method, phishing emails with malicious attachments or links have been used. See an example of a spear phishing tactic.

Compromised Credentials: They leverage stolen or weak credentials to gain initial access.

Tools: Vice Society utilizes various tools for lateral movement and privilege escalation, including:

Techniques:

PortStarter: A backdoor written in Go, used for modifying firewall settings and opening ports.

Scheduled Tasks: Creating scheduled tasks to maintain access.

Registry Key Modification: Adding or modifying registry keys, including undocumented autostart keys (T1547.001).

DLL Side-Loading: Exploiting DLL side-loading vulnerabilities to execute malicious code.

Masquerading: Disguising malware and tools as legitimate files.

Process Injection: Injecting malicious code into legitimate processes.

Evasion Techniques: Employing various techniques to evade automated dynamic analysis.

Disabling Security Tools: Attempting to disable antivirus software and delete system logs.

Aggressive Log Deletion: Removing RDP logs and registry entries, and clearing PowerShell console history.

LSASS dumps (using comsvcs.dll and MiniDump).

NTDS dumps for cracking.

Kerberoasting (using PowerSploit's Invoke-Kerberoast).

Data Encryption: Encrypting files and appending the ".v1cesO0ciety" extension (or variants like .v-s0ciety, .v-society for their custom-built ransomware).

Data Exfiltration: Stealing sensitive data before encryption for double extortion.

Account Access Removal: Changing victims' network account passwords to impede remediation efforts.

PowerShell scripts with hardcoded attacker IPs and wide-ranging keywords.

Suspected use of Rclone and MegaSync for uploading to cloud storage.

File compression tools.

Initially: HelloKitty/FiveHands and Zeppelin ransomware families.

Currently: Custom ransomware builder and stronger encryption methods, with indications of potential association with Rhysida ransomware.

Prioritize patching of internet-facing applications and systems. A patch management strategy is important to have.

Pay particular attention to vulnerabilities known to be exploited by Vice Society, such as PrintNightmare (CVE-2021-1675, CVE-2021-34527).

Implement a robust patch management process, including regular vulnerability scanning and prompt patching.

Enforce strong password policies, including complexity requirements and regular password changes.

Implement multi-factor authentication (MFA) for all user accounts, especially for remote access and privileged accounts.

Regularly review and remove dormant or unnecessary accounts.

Implement the principle of least privilege, granting users only the access they need to perform their job duties.

Implement network segmentation to limit the lateral movement of attackers.

Deploy network intrusion detection and prevention systems (IDS/IPS) to monitor for malicious activity.

Use a firewall to restrict inbound and outbound traffic, particularly on sensitive ports.

Secure Remote Desktop Protocol (RDP) usage:

Deploy endpoint detection and response (EDR) solutions to monitor for and respond to malicious activity on endpoints.

Use anti-malware software with real-time detection and automatic updates.

Enable attack surface reduction rules, particularly those related to PowerShell execution and credential theft.

Enable tamper protection to prevent attackers from disabling security features.

Implement DLP solutions to monitor and prevent the exfiltration of sensitive data.

Configure DLP rules to detect and block the transfer of sensitive data to unauthorized destinations.

Conduct regular security awareness training for all employees, focusing on phishing awareness, safe browsing habits, and password security.

Educate users about the risks of social engineering and how to identify and report suspicious activity.

Develop and regularly test an incident response plan that includes procedures for containing, eradicating, and recovering from ransomware attacks.

Establish clear communication channels and roles and responsibilities for incident response. A cyber incident response plan is very helpful in that case.

Maintain offline, encrypted, and immutable backups of critical data.

Have a recovery plan to restore data and systems quickly in case of an attack.

Utilize threat intelligence feeds to stay informed about the latest TTPs used by Vice Society and other ransomware groups.

Incorporate threat intelligence into security controls to proactively block known indicators of compromise (IOCs).

Address Budgetary Constraints: Advocate for increased funding for cybersecurity within educational institutions.

Implement BYOD Policies: Develop and enforce strong Bring Your Own Device (BYOD) policies to manage the security risks associated with personal devices.

Prioritize Staff Training: Provide specialized cybersecurity training for IT staff and educators.

Leverage Endpoint Protection Platforms (EPP): Use EPPs with machine learning capabilities, behavioral analysis, and sandboxing capabilities to detect and mitigate attacks.

Ransomware Rollback Options: Use solutions that can roll back changes, and implement local caches of data file changes. An introduction to Ubuntu might be useful here.