Knowledge Base
Rhysida
Rhysida is noteworthy for its focus on organizations in the education industry, followed by those in health care equipment & services, and the public sector.
Ransomware Leak Sites
Vice Society
Active Since
May 2021 (last active June 2023)
Total Victims as of January 2024
181
Known Forum Aliases
N/A
Active Forum Accounts
N/A
Top Targeted Geographies
US, UK, France
Vice Society was a ransomware/data extortion operation that primarily targeted organizations in the education sector.
It gained notoriety for conducting a spree of attacks towards the end of 2022 and beginning 2023 on institutions in North America and Europe including the Los Angeles Unified School District, University Institute of Technology of Paris, and The University of Duisburg-Essen.
In February 2023 we published a report on a pattern of dark web traffic to the networks of Vice Society’s victims, which we assessed with medium confidence was a precursor to the group’s attacks.
Vice Society stopped posting victims to its dark web leak site in June 2023 and the site went offline in December. However, once again, this doesn’t necessarily mean the actors behind the group have left the ransomware scene for good. Some security analysts, including those at Check Point Research, have identified similarities in the Tactics, Techniques and Procedures (TTPs) of Vice Society and those used by Rhysida, a ransomware operation that emerged in 2023.
Related Content
Podcasts
Ransomware Gangs on the Dark Web
Knowledge Base
8Base
8Base uses a variant of Phobos ransomware, modified to append a ".8base" extension. Researchers have also noted that 8Base's leak site bears similarities to the data extortion operation RansomHouse.
Videos
How can you identify ransomware operators targeting you on the dark web?
Knowledge Base
Cl0p
Cl0p is notable for its approach of using vulnerabilities in supply chain software to target multiple organizations, announcing them in a batch at a later date.
Knowledge Base
LockBit
LockBit was the most active ransomware group by number of listed victims on its dark web leak site in 2022 and 2023. In February 2024 its leak site was seized in Operation Cronos.
Knowledge Base
Royal
Royal initially used third-party ransomware including BlackCat and Zeon before developing its own malware, written in C++, which infects Windows systems.
