Ransomware Group intelligence

Vicesociety

Inactive

Track Vicesociety with 191 published victims and 9 known leak locations in a single intelligence view.

BREACH HOUSE ALERTS

Want an alert every time a new ransomware post is published?

Choose the feeds and the countries you care about — we email you when they move.

Victims 191 Known published victims in this dataset

First discovered 2021-05-31 Earliest victim discovery date

Last discovered 2023-06-20 Latest victim discovery date

Inactive since 1169 days Days since the latest known victim

Top country United States 7 victims

Known locations 9 Leak or negotiation infrastructure tracked

Vicesociety is tracked by Breach House as a ransomware group with 191 published victims.

United States is currently the most targeted country in this dataset.

9 known leak locations are currently associated with this group.

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 9	Onion service	Down checked 2h ago	`bianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad.onion`
Leak location 8	Onion service	Down checked 2h ago	`xu66gzit6zp22qvixpenlxu2ok7vzrpqvgkuupkiukpz47va47ewbwad.onion`
Leak location 7	Onion service	Down checked 2h ago	`tahnytazh47jpikpajm2so2jdsjrkx6gfcu4p7bu7u3vfarnpvshgeyd.onion`
Leak location 6	Onion service	Down checked 2h ago	`ml3mjpuhnmse4kjij7ggupenw34755y4uj7t742qf7jg5impt5ulhkid.onion`
Leak location 5	Onion service	Down checked 2h ago	`ssq4zimieeanazkzc5ld4v5hdibi2nzwzdibfh5n5w4pw5mcik76lzyd.onion`
Leak location 4	Onion service	Down checked 2h ago	`wmp2rvrkecyx72i3x7ejhyd3yr6fn5uqo7wfus7cz7qnwr6uzhcbrwad.onion`
Leak location 2	Onion service	Down checked 2h ago	`vsociethok6sbprvevl4dlwbqrzyhxcxaqpvcqt5belwvsuxaxsutyad.onion`
Leak location 3	Onion service	Down checked 2h ago	`ecdmr42a34qovoph557zotkfvth4fsz56twvwgiylstjup4r5bpc4oad.onion`
Leak location 1	Onion service	Down checked 2h ago	`4hzyuotli6maqa4u.onion`

Not identified 56
Education 52
Communication / Marketing 12
Public Sector 12
Services 11
Healthcare / Pharma 11
Finance / Legal / Insurance 6
Retail / E-commerce 5
IT 5
Manufacturing / Engineering 4
Construction / Real Estate 3
Telecommunications 3
Agriculture / Food 2
Hospitality / Food & Beverage / Tourism 2
NGOs / Associations 2
Energy 1
Transportation / Travel / Logistics 1

Typical Attacks (9)

▼

MITRE ATT&CK does not currently catalogue Vicesociety, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.

T1059.001 PowerShell Execution

What they do: vicesociety executes malicious payloads using PowerShell scripts to stage ransomware deployment across compromised systems.

What that means: Adversaries may abuse PowerShell commands and scripts for execution.
T1547.001 Registry Run Keys / Startup Folder PersistencePrivilege Escalation

What they do: vicesociety persists by injecting malicious registry run keys to ensure ransomware reactivation after system reboots.

What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
T1685 Disable or Modify Tools Defense Impairment

What they do: vicesociety disables antivirus tools and security monitoring solutions using registry modifications and service termination commands.

What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
T1070.004 File Deletion Stealth

What they do: vicesociety deletes Volume Shadow Copies and backup directories via vssadmin commands to prevent data recovery.

What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
T1018 Remote System Discovery Discovery

What they do: vicesociety discovers remote systems via Remote System Discovery to map the victim network for targeted encryption.

What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
T1135 Network Share Discovery Discovery

What they do: vicesociety scans network shares to identify victim directories and victim data for exfiltration or encryption targets.

What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
T1021.002 SMB/Windows Admin Shares Lateral Movement

What they do: vicesociety moves laterally through SMB/Windows Admin Shares to propagate ransomware binaries across networked hosts.

What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
T1486 Data Encrypted for Impact Impact

What they do: vicesociety encrypts victim files using custom ransomware binaries with cryptographic keys derived from victim system data.

What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
T1491.001 Internal Defacement Impact

What they do: vicesociety displays internal defacement messages and ransom notes on victim workstations to pressure decryption payments.

What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.

Tools Observed (15)

▼

Software Vicesociety has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Discovery & enumeration

Advanced IP Scanner Advanced Port Scanner

Exfiltration

MEGA RClone WinSCP

LOLBAS (living-off-the-land binaries)

Minidump NTDS Utility (ntdsutil) PsExec WMIC

Networking & tunnelling

Proxychains

Offensive security tooling

Cobalt Strike Impacket PowerShell Empire PowerSploit

Remote monitoring & management

PowerAdmin

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

Ransom Notes (1)

▼

The note this group leaves on a compromised machine. Click a filename to read it.

vicesociety.txt txt · 978 chars

ALL YOUR FILES HAVE BEEN ENCRYPTED BY VICE SOCIETY

All your important documents, photos, databases were stolen and encrypted.

If you do not contact us in 7 days we will upload your files to darknet!

The only method of recovering files is to purchase an unique private key.


We are the only who can give you tool to recover your files.

To proove that we have the key and it works you can send us 2 files and we decrypt it for free (not more than 2 MB each).

This file should be not valuable!

Write to email: CoryFrempton@onionmail\.org

Alternative email: DanyTron@onionmail\.org

v-society.official@onionmail\.org

Attention!

Do not rename encrypted files.

Do not try to decrypt your data using third party software, it may cause permanent data loss.

Decryption of your files with the help of third parties may cause increased price (they add their fee to ours) or you can become a victim of a scam.

Visit our website 4hzyuotli6maqa4u\.onion 

Use tor browser to open

View on RansomLook

Ransom-note text from RansomLook, licensed CC BY 4.0.

Victims (191)

Search, filter and paginate the victim timeline for Vicesociety. Showing 101–191 of 191.

Type	Target	Discovered	Country	Business Category	Intel Link
Ransomware	Consejo Superior de id3969 View details	2022-08-18		Other	—
No additional victim description available. ID 3969
Ransomware	Vygon Spain id3957 View details	2022-08-16		Other	—
No additional victim description available. ID 3957
Ransomware	CHDE POLSKA id3843 View details	2022-07-21		Other	—
No additional victim description available. ID 3843
Ransomware	Edenfield id3838 View details	2022-07-20		Other	—
No additional victim description available. ID 3838
Ransomware	XQUADRAT GmbH id3827 View details	2022-07-19		Other	—
No additional victim description available. ID 3827
Ransomware	San Luis Coastal Unified id3826 View details	2022-07-19		Other	—
No additional victim description available. ID 3826
Ransomware	Vectalia group id3734 View details	2022-07-04		Services	—
No additional victim description available. ID 3734
Ransomware	Ministry of Agriculture Rebublic Indonesia id3691 View details	2022-06-27	Indonesia	Agriculture / Food	—
Indonesia's rich natural resources are influenced by its tropical climate and geographical location between two continents, Asia and Australia, and two oceans, the Pacific Ocean and the Indian Ocean. Therefore, Indonesia is known as an agrarian country with a variety of products from agriculture, plantations, livestock, fisheries and forestry. ID 3691
Ransomware	Medical University of Innsbruck id3688 View details	2022-06-26		Healthcare / Pharma	—
No additional victim description available. ID 3688
Ransomware	PT Astra Honda Motor id3678 View details	2022-06-22		Other	—
No additional victim description available. ID 3678
Ransomware	Pilton Community College id3677 View details	2022-06-22		Education	—
No additional victim description available. ID 3677
Ransomware	Ospedale Macedonio Melloni id3669 View details	2022-06-21		Other	—
No additional victim description available. ID 3669
Ransomware	Novelty Group id3646 View details	2022-06-15		Services	—
No additional victim description available. ID 3646
Ransomware	Magnum id3642 View details	2022-06-15		Other	—
No additional victim description available. ID 3642
Ransomware	Grand Valley State University id3627 View details	2022-06-13		Education	—
No additional victim description available. ID 3627
Ransomware	Palermo id3612 View details	2022-06-09		Other	—
No additional victim description available. ID 3612
Ransomware	St Paul id3582 View details	2022-06-02		Other	—
No additional victim description available. ID 3582
Ransomware	Acorn Recruitment id3581 View details	2022-06-02		Other	—
No additional victim description available. ID 3581
Ransomware	The De Montfort School id3580 View details	2022-06-02		Education	—
No additional victim description available. ID 3580
Ransomware	The Catholic Foundation id3485 View details	2022-05-20		NGOs / Associations	—
No additional victim description available. ID 3485
Ransomware	Atlanta Perinatal Associates id3471 View details	2022-05-19		Other	—
No additional victim description available. ID 3471
Ransomware	Carmel College id3470 View details	2022-05-19		Education	—
No additional victim description available. ID 3470
Ransomware	Higher School of the Public id3469 View details	2022-05-19		Education	—
No additional victim description available. ID 3469
Ransomware	Trans Technology Pte Ltd. id3413 View details	2022-05-11		IT	—
No additional victim description available. ID 3413
Ransomware	Caldes de Montbui id3412 View details	2022-05-11		Other	—
No additional victim description available. ID 3412
Ransomware	Salud Total id3411 View details	2022-05-11		Other	—
No additional victim description available. ID 3411
Ransomware	ELTA Hellenic Post id3370 View details	2022-05-04		Other	—
No additional victim description available. ID 3370
Ransomware	Haynes Manuals id3369 View details	2022-05-04		Other	—
No additional victim description available. ID 3369
Ransomware	Asia Pacific University id3361 View details	2022-05-03		Education	—
No additional victim description available. ID 3361
Ransomware	Mercadocar Mercantil Ltda. id3319 View details	2022-04-29		Services	—
No additional victim description available. ID 3319
Ransomware	Suhl. City in Germany id3318 View details	2022-04-29		Public Sector	—
No additional victim description available. ID 3318
Ransomware	Associazione Bancaria Italiana id3315 View details	2022-04-29		Finance / Legal / Insurance	—
No additional victim description available. ID 3315
Ransomware	Domingues and Pinho Contadores id3314 View details	2022-04-29		Other	—
No additional victim description available. ID 3314
Ransomware	Building Plastics, Inc. id3313 View details	2022-04-29		Manufacturing / Engineering	—
No additional victim description available. ID 3313
Ransomware	Fonseca Supermarkets id3312 View details	2022-04-29		Retail / E-commerce	—
No additional victim description available. ID 3312
Ransomware	GOLDENDUCK GROUP id3311 View details	2022-04-29		Services	—
No additional victim description available. ID 3311
Ransomware	Levantina, Ingenieria y Construccion id3303 View details	2022-04-28		Other	—
No additional victim description available. ID 3303
Ransomware	Stratton Finance id3302 View details	2022-04-28		Finance / Legal / Insurance	—
No additional victim description available. ID 3302
Ransomware	Est Ensemble id3301 View details	2022-04-28		Other	—
No additional victim description available. ID 3301
Ransomware	CORFERIAS id3296 View details	2022-04-28		Other	—
No additional victim description available. ID 3296
Ransomware	ALMANIE GROUP id3295 View details	2022-04-28		Services	—
No additional victim description available. ID 3295
Ransomware	Mossbourne Federation id3254 View details	2022-04-23		NGOs / Associations	—
No additional victim description available. ID 3254
Ransomware	Centre Hospitalier de Castelluccio id3253 View details	2022-04-22		Healthcare / Pharma	—
No additional victim description available. ID 3253
Ransomware	Small Industries DevelopmentBank of India id3239 View details	2022-04-21	India	Finance / Legal / Insurance	—
Small Industries Development Bank of India is the apex regulatory body for overall licensing and regulation of micro, small and medium enterprise finance companies in India. It is under the jurisdiction of Ministry of Finance, Government of India headquartered at Lucknow and having its offices all over the country. ID 3239
Ransomware	Maristes Hermitage id3235 View details	2022-04-21		Other	—
No additional victim description available. ID 3235
Ransomware	NuLife Med id3191 View details	2022-04-17		Other	—
No additional victim description available. ID 3191
Ransomware	APSM Systems id3002 View details	2022-03-29		Services	—
No additional victim description available. ID 3002
Ransomware	ASPIRO id2997 View details	2022-03-29		Other	—
No additional victim description available. ID 2997
Ransomware	Ciments Guyanais id2996 View details	2022-03-29		Other	—
No additional victim description available. ID 2996
Ransomware	OSSEG Obra Social del Seguro id2991 View details	2022-03-28		Other	—
No additional victim description available. ID 2991
Ransomware	Jammal Trust Bank id2986 View details	2022-03-28		Finance / Legal / Insurance	—
No additional victim description available. ID 2986
Ransomware	Establishment of the Agency for the Environmental Protection of the Marche Region id2954 View details	2022-03-24		Communication / Marketing	—
No additional victim description available. ID 2954
Ransomware	ICEHOTEL id2936 View details	2022-03-23		Hospitality / Food & Beverage / Tourism	—
No additional victim description available. ID 2936
Ransomware	Griggsville-Perry High School id2935 View details	2022-03-23		Education	—
No additional victim description available. ID 2935
Ransomware	SENADO Argentina id2821 View details	2022-03-13		Other	—
No additional victim description available. ID 2821
Ransomware	Optionis id2526 View details	2022-01-27		Other	—
No additional victim description available. ID 2526
Ransomware	Butler County Community College id2440 View details	2022-01-14		Education	—
No additional victim description available. ID 2440
Ransomware	Durham Cathedral Schools Foundation id2432 View details	2022-01-12		Education	—
No additional victim description available. ID 2432
Ransomware	Butler Community College id2431 View details	2022-01-12		Education	—
No additional victim description available. ID 2431
Ransomware	XAL id2430 View details	2022-01-12		Other	—
No additional victim description available. ID 2430
Ransomware	SAVANNAH State University id2414 View details	2022-01-09		Education	—
No additional victim description available. ID 2414
Ransomware	Carthage R-9 School District id2413 View details	2022-01-09		Education	—
No additional victim description available. ID 2413
Ransomware	Amaveca Salud id2406 View details	2022-01-07		Other	—
No additional victim description available. ID 2406
Ransomware	Rolle id2398 View details	2022-01-06		Other	—
No additional victim description available. ID 2398
Ransomware	Alliance COAL, LLC id2397 View details	2022-01-06		Services	—
No additional victim description available. ID 2397
Ransomware	Whitehouse id2396 View details	2022-01-06		Other	—
No additional victim description available. ID 2396
Ransomware	FILGO id2395 View details	2022-01-06		Other	—
No additional victim description available. ID 2395
Ransomware	Walter's Automotive Group id2394 View details	2022-01-06		Manufacturing / Engineering	—
No additional victim description available. ID 2394
Ransomware	Gateway College id2393 View details	2022-01-06		Education	—
No additional victim description available. ID 2393
Ransomware	Centre Hospitalier D'Arles id2392 View details	2022-01-06		Healthcare / Pharma	—
No additional victim description available. ID 2392
Ransomware	3V Sigma id2391 View details	2022-01-06		Other	—
No additional victim description available. ID 2391
Ransomware	Eskenazi Health Foundation id2390 View details	2022-01-06		Healthcare / Pharma	—
No additional victim description available. ID 2390
Ransomware	Butali id2389 View details	2022-01-06		Other	—
No additional victim description available. ID 2389
Ransomware	Plastipak Holdings, Inc. id2388 View details	2022-01-06		Services	—
No additional victim description available. ID 2388
Ransomware	Barlow Respiratory Hospital id2387 View details	2022-01-06		Healthcare / Pharma	—
No additional victim description available. ID 2387
Ransomware	ROC Mondriaan id2386 View details	2022-01-06		Other	—
No additional victim description available. ID 2386
Ransomware	KESSEL AG id2385 View details	2022-01-06		Other	—
No additional victim description available. ID 2385
Ransomware	Karl Bachl GmbH & Co.KG id2384 View details	2022-01-06		Other	—
No additional victim description available. ID 2384
Ransomware	SRH Holding id2383 View details	2022-01-06		Other	—
No additional victim description available. ID 2383
Ransomware	Manhasset Union Free School District id2382 View details	2022-01-06		Education	—
No additional victim description available. ID 2382
Ransomware	Lufkin Independent School District id2381 View details	2022-01-06		Education	—
No additional victim description available. ID 2381
Ransomware	City of Witten id2380 View details	2022-01-06		Public Sector	—
No additional victim description available. ID 2380
Ransomware	Holy Family RC & CE College id2379 View details	2022-01-06		Education	—
No additional victim description available. ID 2379
Ransomware	Hawthorn The Community Pub Co. id2378 View details	2022-01-06		Other	—
No additional victim description available. ID 2378
Ransomware	Pontificia Universidad Javeriana id2377 View details	2022-01-06		Other	—
No additional victim description available. ID 2377
Ransomware	DFL id2376 View details	2022-01-06		Other	—
No additional victim description available. ID 2376
Ransomware	Spar id2375 View details	2022-01-06		Other	—
No additional victim description available. ID 2375
Ransomware	OSSEG Obra Social de Seguros id2341 View details	2022-01-01		Other	—
No additional victim description available. ID 2341
Ransomware	Universidade Federal de Sao Paulo id2340 View details	2022-01-01		Public Sector	—
No additional victim description available. ID 2340
Ransomware	United Health Centers id684 View details	2021-08-31	United States	Healthcare / Pharma	—
No additional victim description available. ID 684
Ransomware	City of Rolle id642 View details	2021-05-31	Switzerland	Public Sector	—
No additional victim description available. ID 642