#StopRansomware: Vice Society | CISA

MITRE Techniques

• [T1190] Exploit Public-Facing Application – “Vice Society actors exploit vulnerabilities in an internet-facing systems to gain access to victims’ networks.”
• [T1078] Valid Accounts – “Vice Society actors obtain initial network access through compromised valid accounts.”
• [T1047] Windows Management Instrumentation (WMI) – “Vice Society actors leverage WMI as a means of “living off the land” to execute malicious commands.”
• [T1053] Scheduled Task/Job – “Vice Society have used malicious files that create component task schedule objects, which are often mean to register a specific task to autostart on system boot.”
• [T1543.003] Modify System Process – “Vice Society actors encrypt Windows Operating functions to preserve compromised system functions.”
• [T1547.001] Registry Run Keys/Startup Folder – “Vice Society actors have employed malicious files that create an undocumented autostart Registry key to maintain persistence after boot/reboot.”
• [T1574.002] DLL Side-Loading – “Vice Society actors may directly side-load their payloads by planting their own DLL then invoking a legitimate application that executes the payload within that DLL.”
• [T1068] Exploitation for Privilege Escalation – “Vice Society actors have been observed exploiting PrintNightmare vulnerability (CVE-2021-1675 and CVE-2021-34527) to escalate privileges.”
• [T1036] Masquerading – “Vice Society actors may attempt to manipulate features of the files they drop in a victim’s environment to mask the files or make the files appear legitimate.”
• [T1055] Process Injection – “Vice Society artifacts have been analyzed to reveal the ability to inject code into legitimate processes…”
• [T1497] Sandbox Evasion – “Vice Society actors may have included sleep techniques in their files to hinder common reverse engineering or dynamic analysis.”
• [T1080] Taint Shared Content – “Vice Society actors may deliver payloads to remote systems by adding content to shared storage locations such as network drives.”
• [TA0010] Exfiltration – “Vice Society actors are known for double extortion, which is a second attempt to force a victim to pay by threatening to expose sensitive information if the victim does not pay a ransom.”
• [T1486] Data Encrypted for Impact – “Vice Society actors have encrypted data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.”
• [T1531] Account Access Removal – “Vice Society actors run a script to change passwords of victims’ email accounts.”