How Vice Society got away with a global ransomware spree

The Los Angeles Unified School District's digital operations were crippled in the first week of September due to a cyberattack. Two weeks after the initial attack, as the district worked to recover and restore its systems, the hackers said that they would leak the 500 gigabytes of data they claimed to have stolen from LAUSD.

After the school system refused to pony up, the hackers released the trove, which contained sensitive data of students who had attended LAUSD, including their Social Security numbers, financial and tax information, health details, and even legal records The hacking group behind the attack moved on despite the LAUSD setting up a hotline for worried families.

Vice society is for you.

The apparently Russian-speaking group is a prolific ransomware actor that has hit an array of educational institutions since emerging at the end of 2020. But in addition to focusing on schools, Vice Society is notorious for targeting health care facilities and hospitals—a sector long-plagued by ransomware attacks, but one that some hacking groups pledged not to target at the height of the COVID-19 pandemic. Amidst a nonetheless brutal wave of North American hospital ransomware attacks in 2020, though, Vice Society's activity has been just unremarkable enough to keep the group out of the spotlight. Advertisement

Allan Liska, an analyst for the security firm Recorded Future, says that they would think of them as a second or third tier group compared to LockBit, Hive, and Black Cat. The majority of their victims are either in the education or health care sectors, and their attacks make up a significant chunk of the total attacks so far. They loom large in that area.

Vice society is an unremarkable gang. The group relies on exploiting known vulnerabilities like Print Nightmare to gain access to victims' systems and may sometimes buy a foot in the door from criminal actors. Vice Society takes advantage of an organization's own network management tools to conduct standard espionage. The group deploys a piece of computer software.

The FBI and the US Cybersecurity and Infrastructure Security Agency published an alert about Vice Society after the LAUSD attack. Vice Society is an intrusion, exfiltration, and extortion hacking group.

Vice Society has hit targets around the world and spread its victims between North America, South America, and Europe.