In the murky waters of the cybersecurity world, Vice Society—a notorious Russian-speaking hacking collective—has taken center stage once again. This time, they’re wielding INC ransomware to wreak havoc on the healthcare sector. The healthcare industry, which is already overloaded with privacy regulations, stretched budgets, and non-stop patient data, has become a prime target for these cyber villains. Microsoft Threat Intelligence posted about this incident on their X account, identifying the attackers as “Vanilla Tempest,” which is another alias for Vice Society. Microsoft and other cybersecurity experts track this group under different names, including Vanilla Tempest and DEV-0832, but make no mistake—they’re all the same threat actor with a penchant for causing chaos.
According to a report published by PolySwarm (props to them for digging into this mess), Vice Society has become quite enamored with using INC ransomware to target healthcare organizations. As it turns out, Vice Society doesn’t even bother with creating their own proprietary ransomware—why build when you can borrow, right? Instead, they mix and match existing ransomware families like Hello Kitty, Zeppelin, and their new favorite, INC.
Who (or What) is Vice Society?
First things first: if you’re imagining Vice Society as a quirky, underground cyber secret society, think again. These folks are a financially motivated, Russian-speaking threat actor group that targets sectors ripe for exploitation, including healthcare, education, IT, and manufacturing. They operate under multiple aliases, including Vanilla Tempest and DEV-0832, depending on which cybersecurity group is tracking them. However, no matter what name they’re using, their tactics remain the same: repurposing existing ransomware variants instead of developing their own. Why innovate when you can terrorize with off-the-shelf malware?
Vice Society’s recent shenanigans involve using INC ransomware to break into healthcare networks. As of 2023, they’ve been busy locking up the data of hospitals and local governments alike—just ask the NHS in Scotland or Leicester City Council, both of which have suffered at the hands of this ransomware. Their tactics are simple yet effective: get in, lock everything up, and demand a payout. And don’t forget the double whammy of extortion. If you refuse to pay, they’ll threaten to release your sensitive data to the highest bidder. Charming, aren’t they?
The Vice Society Playbook
Step 1: Locate a vulnerable healthcare system. Bonus points if it’s under pressure (because healthcare systems aren’t stressed enough, right?).
Step 2: Deploy INC ransomware and sit back while it encrypts the victim’s data in record time.
Step 3: Demand a ransom for the decryption key, and if that doesn’t work, sell or leak the stolen data. Why hold back?
What Makes INC Ransomware So Dangerous?
INC ransomware is a new-ish player in the ransomware game, but don’t let that fool you—it’s got some tricks up its sleeve. First observed in mid-2023, INC is notable for its speed and efficiency. Using multithreading (a fancy way of saying it can work on multiple tasks at once), INC encrypts data faster than you can say “data breach.” This nasty piece of work doesn’t mess around—it encrypts critical files and even deletes Volume Shadow Copies, making recovery nearly impossible without forking over the ransom.
INC ransomware also has a flair for the dramatic. In some cases, it leaves a ransom note not just digitally but physically, printing it out via connected printers. Yes, that’s right—it’s as if the hackers are saying, “Just in case you missed our digital extortion notice, here’s a printed copy for your convenience.” How thoughtful!
Key Features of INC Ransomware:
- Multithreading: This allows it to encrypt data super-fast, because who has time to wait?
- Selective encryption: It avoids certain file types like .exe and .dll to ensure the system remains functional while your precious data gets locked up.
- Shadow Copy deletion: It removes backup copies to prevent you from simply restoring your system. You know, just in case you were feeling hopeful.
Once encrypted, your files are held hostage, and Vice Society demands a ransom for their safe return. But here’s the kicker: even if you do pay up, there’s no guarantee you’ll get your data back. After all, these aren’t exactly trustworthy businesspeople we’re dealing with.
Lateral Movement: The Cybercriminal’s Path of Least Resistance
So how does Vice Society spread INC ransomware so effectively? They don’t just waltz in through the front door, that’s for sure. Instead, they use a combination of Gootloader infections (carried out by Storm-0494, in case you’re keeping track), backdoor access through tools like Supper and AnyDesk, and the infamous Remote Desktop Protocol (RDP) for lateral movement across networks. Essentially, once they’ve got a foothold, they’ll move sideways through your network faster than a nurse on a double shift.
It gets worse. Vice Society uses Windows Management Instrumentation (WMI) to deploy their malicious payloads—basically turning your own systems against you. And if your IT department hasn’t disabled Remote Desktop, well, you’ve just rolled out the red carpet for these cybercriminals.
Vice Society’s Greatest Hits: High-Profile Victims and Extortion Tactics
Vice Society loves a good challenge. Healthcare systems, educational institutions, and IT companies make for irresistible targets. And why wouldn’t they? These sectors typically operate with sprawling networks, plenty of sensitive data, and just enough bureaucracy to keep security on the back burner.
But Vice Society doesn’t stop at data encryption. Their attacks often include double extortion: they demand payment for decryption, and if that doesn’t work, they’ll threaten to release the stolen data on the dark web. They’ve got this whole “maximum damage” thing down to an art. Imagine trying to explain to your patients why their private medical records are being auctioned off to the highest bidder.
A Few Vice Society Hits:
- Leicester City Council: They’ve had to deal with the joys of INC ransomware. The attack severely impacted local services, and it wasn’t pretty.
- NHS Services in Scotland: The hackers didn’t just disrupt healthcare operations—they forced essential services to resort to pen and paper for record-keeping. Welcome to the 1800s, folks.
Why Healthcare? Why Now?
The healthcare sector is low-hanging fruit for Vice Society. With complex networks and a priority on availability over security, hospitals and other medical institutions are prime targets. Moreover, healthcare data is incredibly valuable on the dark web. Medical records can sell for up to $1,000 per record, depending on the information they contain. Compare that to credit card information, which is often sold for $10 a pop, and you’ll see why cybercriminals are so interested in this sector.
The operational impact is also significant. Hospitals can’t afford downtime—lives are literally on the line. This makes them more likely to pay the ransom just to get their systems back up and running, rather than risk prolonged outages while they try to rebuild their IT infrastructure.
Proactive Measures: How to Defend Against INC Ransomware
By now, you’re probably wondering what you can do to avoid becoming Vice Society’s next victim. Well, don’t despair. With a little foresight, you can turn your organization from an easy target into a fortress of digital security.
Here are some defensive measures to consider:
- Patch Early, Patch Often: Keep your systems up to date with the latest security patches. Many ransomware attacks exploit known vulnerabilities that could easily be patched.
- Disable Remote Desktop (RDP): RDP is a common attack vector, so disable it unless it’s absolutely necessary. If you have to use it, lock it down with multi-factor authentication and strict access controls.
- Regular Backups: Backup your data frequently and store those backups offline. If your main systems are encrypted, you’ll need those backups to restore your files.
- Multi-Factor Authentication (MFA): Strengthen your security by requiring MFA. It adds an extra layer of protection, ensuring that even if someone gets hold of a password, they’ll still need another form of verification.
- Network Monitoring: Keep an eye on your network for any suspicious activity. Early detection can prevent a full-scale attack.
The Role of CVEs in Ransomware Attacks
The reality is, many ransomware attacks start with exploiting known vulnerabilities—those little cracks in your system that were publicly disclosed but never patched. These vulnerabilities are listed as Common Vulnerabilities and Exposures (CVEs). Hackers love CVEs because they’re essentially an open invitation to waltz into your system.
Some of the CVEs that are frequently used in ransomware attacks include:
- CVE-2021-34527, the infamous PrintNightmare vulnerability affecting Windows Print Spooler.
- CVE-2019-0708, better known as BlueKeep, which allows for remote code execution in Remote Desktop Services.
Organizations must be proactive in identifying and patching these vulnerabilities before the bad guys exploit them.
FAQs
What is INC ransomware?
INC ransomware is a type of malware that encrypts data and demands a ransom to decrypt it. It’s known for its speed and efficiency, using multithreading to encrypt data quickly while avoiding certain file types to keep the system running. It’s heavily favored by Vice Society, also tracked as Vanilla Tempest or DEV-0832, in their attacks.
How does Vice Society deliver INC ransomware?
Vice Society leverages Gootloader infections, backdoor access via AnyDesk, and moves laterally across networks using Remote Desktop Protocol (RDP) and WMI. They’re skilled at using multiple entry points to maximize their attack surface.
What sectors does Vice Society target?
Vice Society mainly focuses on healthcare, IT, manufacturing, and education sectors. Their victims often have large, complex networks and sensitive data, making them appealing targets for ransomware attacks.
How can organizations protect themselves against ransomware?
Organizations can protect themselves by regularly updating their systems, disabling unnecessary services like RDP, implementing multi-factor authentication, and maintaining offline backups of critical data. Regular network monitoring for suspicious activity is also essential.
Final Thoughts: Prevention is the Best Medicine
In the escalating war against ransomware, Vice Society’s use of INC ransomware is just the latest reminder that healthcare systems are under siege. If you’re part of the healthcare industry or any sector with sensitive data, now is the time to act. Don’t wait until it’s too late—fortify your defenses, patch your systems, and ensure your data is backed up and secure.
The fight against cybercrime might seem overwhelming, but it’s a battle you can win with the right precautions. So patch up, lock down, and keep an eye out for suspicious activity—because in this world, it’s not a matter of if you’ll be attacked, but when.
