# Vice Society targets K-12 education with double-extortion ransomware

Published: 2025-07-21 · Severity: elevated · Sectors: education
Canonical: https://vorant.io/reports/bae2e03d-a8d1-54d4-be5f-9bbf475cc0ea/vice-society-targets-k-12-education-with-double-extortion-ransomware

> Vice Society ransomware group targets education sector with Hello Kitty and Zeppelin variants using credential compromise and lateral movement.

Vice Society is an intrusion and exfiltration group active since summer 2021 that conducts double-extortion ransomware attacks, disproportionately targeting the K-12 education sector. The group deploys Hello Kitty/Five Hands and Zeppelin ransomware variants and gains initial access through compromised credentials and exploitation of internet-facing applications. Prior to encryption, actors perform extensive network reconnaissance, lateral movement via Cobalt Strike, SystemBC, and PowerShell Empire, and data exfiltration for extortion purposes. They escalate privileges using the PrintNightmare vulnerability (CVE-2021-1675, CVE-2021-34527) and maintain persistence through scheduled tasks, registry autostart keys, and DLL side-loading. The group uses Windows Management Instrumentation, process injection, and file masquerading to evade detection.

Education institutions are targeted because they hold sensitive student and staff data, often have constrained cybersecurity resources, and operate under pressure to resume services quickly. Attacks have resulted in network lockdowns, exam delays, canceled school days, and data theft. CISA, FBI, and MS-ISAC issued this advisory in September 2022 and anticipate increased attacks as school years begin. The advisory provides file hashes from recent incident response cases and extensive defensive guidance covering backup resilience, identity and access controls, network segmentation, RDP hardening, and vulnerability management.

## Mentioned in this report

- Vulnerabilities: CVE-2021-1675 (KEV), CVE-2021-34527 (KEV)
- Threat actors: Vice Society
- Malware: Cobalt Strike, FIVEHANDS, HELLOKITTY, PowerShell Empire, SystemBC, Zeppelin

## Detection guidance (public sample)

### Print Spooler Spawning Shell or Script Interpreter (PrintNightmare Exploitation)

ATT&CK: T1068

spoolsv.exe spawning a command shell, PowerShell, or script host, consistent with PrintNightmare (CVE-2021-34527 / CVE-2021-1675) privilege escalation as used by Vice Society. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Print Spooler Spawning Shell or Script Interpreter (PrintNightmare Exploitation)
description: Detects the Windows Print Spooler service spawning command interpreters
  or script hosts. This is a typical post-exploitation outcome of PrintNightmare (CVE-2021-34527
  / CVE-2021-1675) used for local privilege escalation. Generalises on the parent/child
  relation, not on specific payload names.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \spoolsv.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \rundll32.exe
    - \mshta.exe
    - \wscript.exe
    - \cscript.exe
  filter_driver_install:
    CommandLine|contains: \spool\drivers\
  condition: selection and not filter_driver_install
falsepositives:
- Third-party printer driver or print management software that launches helper scripts
  from the spooler service
- Legacy print monitors that invoke cmd.exe during job processing
level: high
id: 239245b5-ee5e-5b14-8099-a978e4c69519
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-249a
```

### Cobalt Strike Default Named Pipe Created

ATT&CK: T1055

Creation of named pipes matching known Cobalt Strike defaults (WkSvcPipeMgr_*, MSSE-*-server, hashdump), used for lateral movement and injected-process communication. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cobalt Strike Default Named Pipe Created
description: Detects creation of named pipes that match known Cobalt Strike default
  or commonly used patterns. Vice Society used Cobalt Strike for lateral movement
  and process injection. Requires Sysmon pipe events (Event ID 17).
tags:
- attack.stealth
- attack.t1055
logsource:
  category: pipe_created
  product: windows
detection:
  selection:
    PipeName:
    - \WkSvcPipeMgr_*
    - \MSSE-*-server
    - \hashdump
  condition: selection
falsepositives:
- Red team or penetration test exercises using default Cobalt Strike profiles
- Rare legacy security software that uses MSSE-style pipe names
level: high
id: 220c7396-fe1e-5e4b-a91c-c848f56957dc
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-249a
```

### WMI Remote Process Creation via WMIC

ATT&CK: T1047

wmic.exe used with /node and process call create to execute commands on remote hosts, consistent with WMI-based lateral movement before ransomware deployment. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WMI Remote Process Creation via WMIC
description: Detects wmic.exe invoking process call create against a remote node,
  a common lateral movement technique used before ransomware deployment. Generalises
  on the /node plus process call create pattern rather than on specific payloads.
tags:
- attack.execution
- attack.lateral-movement
- attack.t1047
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
  - Image|endswith: \wmic.exe
  - OriginalFileName: wmic.exe
  selection_args:
    CommandLine|contains|all:
    - /node
    - process
    - call
    - create
  condition: selection_img and selection_args
falsepositives:
- Legacy administrative scripts or software deployment tooling that uses wmic for
  remote installs
level: medium
id: b525a1ec-86b5-568c-8a8c-705c6221c54c
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-249a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-249a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/bae2e03d-a8d1-54d4-be5f-9bbf475cc0ea/vice-society-targets-k-12-education-with-double-extortion-ransomware.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup