You're listening to the CyberWire Network, powered by N2K.

This is a SISA Cybersecurity Alert.

ID number Alpha Alpha 22 TAC-249 Alpha,

Original release date, September 6, 2022.

CISA, the FBI, and the Multistate Information Sharing and Analysis Center,

or MSISAC, are releasing this advisory to disseminate

indicators of compromise and TTPs associated with Vice Society actors and their ransomware campaigns.

The FBI, CISA, and the-ISAC have recently observed Vice Society actors

disproportionately targeting the education sector with ransomware attacks.

Vice Society is an intrusion, exfiltiltration, and extortion hacking group that first appeared in summer 2021.

Vice Society actors do not use a ransomware variant of unique origin.

Instead, the actors have deployed versions of Hello Kitty, Five Hands, and Zeppelin Ransom

where and may deploy other variants.

Vice society actors obtain initial network access through compromised credentials by exploiting internet-facing applications.

Vice society actors have been observed exploiting the print nightmare vulnerability to escalate privileges.

Prior to deploying ransomware, the actors spend time exploring the network, identifying opportunities

to increase accesses, and exfiltrating data for double extortion. Vice society actors have

been observed using a variety of tools, including System BC, Power Shell Empire, and Cobalt

strike for lateral movement.

They have also used living off-the-land techniques targeting the legitimate Windows

Management Instrumentation Service and Tainting shared content.

Over the past several years, the education sector, especially K through 12 institutions,

...