Vice Society targets K-12 education with double-extortion ransomware

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Vice Society ransomware group targets education sector with Hello Kitty and Zeppelin variants using credential compromise and lateral movement.

Vice Society is an intrusion and exfiltration group active since summer 2021 that conducts double-extortion ransomware attacks, disproportionately targeting the K-12 education sector. The group deploys Hello Kitty/Five Hands and Zeppelin ransomware variants and gains initial access through compromised credentials and exploitation of internet-facing applications. Prior to encryption, actors perform extensive network reconnaissance, lateral movement via Cobalt Strike, SystemBC, and PowerShell Empire, and data exfiltration for extortion purposes. They escalate privileges using the PrintNightmare vulnerability (CVE-2021-1675, CVE-2021-34527) and maintain persistence through scheduled tasks, registry autostart keys, and DLL side-loading. The group uses Windows Management Instrumentation, process injection, and file masquerading to evade detection.

Education institutions are targeted because they hold sensitive student and staff data, often have constrained cybersecurity resources, and operate under pressure to resume services quickly. Attacks have resulted in network lockdowns, exam delays, canceled school days, and data theft. CISA, FBI, and MS-ISAC issued this advisory in September 2022 and anticipate increased attacks as school years begin. The advisory provides file hashes from recent incident response cases and extensive defensive guidance covering backup resilience, identity and access controls, network segmentation, RDP hardening, and vulnerability management.

title: Print Spooler Spawning Shell or Script Interpreter (PrintNightmare Exploitation)
description: Detects the Windows Print Spooler service spawning command interpreters
  or script hosts. This is a typical post-exploitation outcome of PrintNightmare (CVE-2021-34527
  / CVE-2021-1675) used for local privilege escalation. Generalises on the parent/child
  relation, not on specific payload names.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \spoolsv.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \rundll32.exe
    - \mshta.exe
    - \wscript.exe
    - \cscript.exe
  filter_driver_install:
    CommandLine|contains: \spool\drivers\
  condition: selection and not filter_driver_install
falsepositives:
- Third-party printer driver or print management software that launches helper scripts
  from the spooler service
- Legacy print monitors that invoke cmd.exe during job processing
level: high
id: 239245b5-ee5e-5b14-8099-a978e4c69519
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-249a

title: Cobalt Strike Default Named Pipe Created
description: Detects creation of named pipes that match known Cobalt Strike default
  or commonly used patterns. Vice Society used Cobalt Strike for lateral movement
  and process injection. Requires Sysmon pipe events (Event ID 17).
tags:
- attack.stealth
- attack.t1055
logsource:
  category: pipe_created
  product: windows
detection:
  selection:
    PipeName:
    - \WkSvcPipeMgr_*
    - \MSSE-*-server
    - \hashdump
  condition: selection
falsepositives:
- Red team or penetration test exercises using default Cobalt Strike profiles
- Rare legacy security software that uses MSSE-style pipe names
level: high
id: 220c7396-fe1e-5e4b-a91c-c848f56957dc
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-249a

title: WMI Remote Process Creation via WMIC
description: Detects wmic.exe invoking process call create against a remote node,
  a common lateral movement technique used before ransomware deployment. Generalises
  on the /node plus process call create pattern rather than on specific payloads.
tags:
- attack.execution
- attack.lateral-movement
- attack.t1047
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
  - Image|endswith: \wmic.exe
  - OriginalFileName: wmic.exe
  selection_args:
    CommandLine|contains|all:
    - /node
    - process
    - call
    - create
  condition: selection_img and selection_args
falsepositives:
- Legacy administrative scripts or software deployment tooling that uses wmic for
  remote installs
level: medium
id: b525a1ec-86b5-568c-8a8c-705c6221c54c
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-249a

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-249a