Vice Society (also known as DEV-0832 or Vanilla Tempest)
Vice Society was a financially motivated cybercriminal group that ran double extortion ransomware operations from the summer of 2021 until its brand went quiet in mid-2023. It's also tracked as Vanilla Tempest, DEV-0832, and Vice Spider. Double extortion means the group stole data before encrypting it, then threatened to publish what it had taken, so that an organization with working backups still had a reason to pay. Two things set the group apart. It never built its own ransomware for most of its run, deploying families obtained from other criminals instead, and it went after the sectors that many of its peers deliberately avoided. Schools in particular. That focus became prominent enough that the FBI, CISA, and MS-ISAC issued a joint advisory about it in September 2022. Sekoia's Threat Detection & Research (TDR) team profiled the group in June 2022, before it became widely known, drawing on its own analysis of the group's leak site. This page covers what Vice Society was, why the education sector mattered so much to it, and what became of the people behind it, which is the part most published material still gets wrong.
Key takeaways
- Vice Society borrowed its ransomware rather than building it. For most of its run the group deployed families acquired from other criminals, which is unusual for a group of its profile.
- It targeted the sectors others avoided. Education, healthcare, and government appeared on its leak site, with no sign of the self-imposed restrictions some groups apply.
- The tradecraft was ordinary, and that was enough. Stolen credentials, exposed internet-facing applications, and a known Windows vulnerability did most of the work.
- The brand is dormant, the operators are not. Activity under the Vice Society name stopped around mid-2023, while the same cluster has been tracked deploying newer ransomware since.
- Refusing to pay did not prevent publication. The most prominent affected organization declined to pay and its stolen data was published weeks later.
What made Vice Society unusual
Most groups of this size either develop an encryptor or run an affiliate program around one. Vice Society did neither for most of its lifetime. It bought or borrowed ransomware from other criminals and concentrated its own effort on getting into networks, which saved it the cost of building and maintaining malware. The joint government advisory stated the point plainly, noting that the group did not use a ransomware variant of unique origin.
It also appears to have operated as a small centralized team rather than as a service with affiliates. That matters for interpretation, because with affiliate models the brand and the operator are genuinely separate things, whereas here the leak site and the intrusions traced back to more or less the same people.
Sekoia assessed at the time that the group was deliberately keeping a low profile to avoid drawing law enforcement attention, which fits both its modest public presence and its longevity. Its leak site was written in British English with a cynical streak, and TDR assessed that the group may have been presenting a British persona as part of its tradecraft rather than reflecting where its members actually were.
None of this made the group harmless. It made it cheap to run and hard to disrupt, which is a different problem.
Why the education sector mattered
The education focus is the most documented thing about Vice Society, and it's supported from several independent directions rather than resting on any single report.
The reason schools are attractive is unglamorous. K-12 districts hold large volumes of sensitive personal data on children and staff, they often depend on managed service providers, and their security budgets compete directly with teaching budgets. The government advisory made this point directly, and added that districts with strong programs were still exposed because much of the targeting was opportunistic rather than selective.
Asked publicly why it attacked healthcare organizations, the group answered by shifting blame onto the organizations it attacked, arguing that those which failed to protect data had invited the consequences. It's worth recording because it tells you the group had no intention of respecting sector norms, and no appeal to the harm caused was going to change that.
What happened at Los Angeles Unified
The Los Angeles Unified School District was attacked over the US Labor Day weekend in 2022, disrupting systems, applications, and email across a district serving more than 640,000 students. The joint federal advisory on Vice Society was published the same week. The district declined to pay, and the group published data it had stolen in early October. The district later disclosed that the stolen material included personal information belonging to contractors and to people connected with the district.
The case is the clearest illustration of what double extortion actually means for an organization that does the right thing. Refusing to pay a criminal is defensible and often correct, and it did not stop the publication. Any incident plan that treats non-payment as the end of the decision tree is incomplete, because the data disclosure obligations, the notification work, and the harm to the people whose records were taken all still arrive.
How the group got in
The tradecraft was conventional. Initial access came through compromised credentials and internet-facing applications that were exposed or unpatched. For privilege escalation the group was observed abusing PrintNightmare, a widely known Windows print spooler flaw that was public and patched well before these campaigns. Movement inside networks relied on standard administrative tooling rather than custom implants, data was exfiltrated before encryption, and security logs were deleted on the way out, which limited what investigators could reconstruct afterwards.
The reason to state this plainly is that the defensive implications are ordinary too. There was no novel capability here to be countered with a novel control. Credential hygiene, exposure management on internet-facing services, timely patching of known vulnerabilities, and log integrity would each have obstructed this group. The gap it exploited was consistency, not knowledge.
Where Vice Society stands now
Activity under the Vice Society name stopped around mid-2023. There have been no publicly reported arrests or law enforcement takedowns of its operators, so the brand's disappearance is not the same as the group being dismantled.
What the public record does show is a cluster of activity, tracked under several designations, that kept operating while changing the ransomware it deployed. Following that chronology is more useful than following the name.
A word of caution on how this is usually described. You'll frequently read that Vice Society rebranded as Rhysida, stated as settled fact. The careful version is narrower. There's a strong assessed overlap in operators, tradecraft, and timing between the end of Vice Society activity and the rise of Rhysida, which is a substantial finding, and it isn't the same as a confirmed corporate-style rebrand. Some analysis has been explicit that the correlation is compelling without being proof. Treat the overlap as well supported and the word "rebrand" as shorthand rather than as an established fact.
More recently, in October 2025, more than 200 fraudulent code-signing certificates were revoked following a campaign that used malicious search advertising and poisoned search results to push fake Microsoft Teams installers, leading to a backdoor and then ransomware. That delivery pattern belongs to the same fake-installer economy documented elsewhere in this glossary, and it's a reminder that the cluster has kept modernizing its initial access while the ransomware at the end has changed repeatedly.
What Vice Society tells defenders
- A brand is not an adversary. The same operators ran at least four different ransomware families across four years. Defences organized around a name expire when the name does.
- Sector norms are not protection. Assuming that schools or hospitals are off-limits to criminals was never safe, and this group is the proof.
- Ordinary tradecraft deserves ordinary discipline. Credentials, exposed services, known vulnerabilities, and log retention did the work here, which means the countermeasures were available the whole time.
- Non-payment needs a plan attached. Deciding not to pay is legitimate and should be rehearsed alongside notification, legal, and communications work, because publication may follow anyway.
- Log deletion is an intelligence problem, not just a cleanup problem. When logs go, so does the ability to scope the intrusion, which is why forwarding logs off the host matters more than retaining them on it.
- Watch successor activity, not obituaries. When a leak site goes dark, the useful question is which payload the same tradecraft shows up behind next.
Sekoia's contribution here was early and first-party. TDR profiled the group from its own leak-site and sample analysis in mid-2022, and Sekoia Intelligence continues to track ransomware ecosystems including the successor activity described above. Healthcare and government, two of the sectors this group attacked, are among the verticals Sekoia works in directly.
Expert insight: Why a dormant ransomware brand is still worth understanding
There's an argument that a group which stopped operating in 2023 is a history lesson. The counter-argument is what this particular history shows. Across roughly four years, one cluster of people deployed borrowed ransomware under at least four different names, retired a brand that had attracted a federal advisory, and carried on. The brand was the most disposable part of the operation. The tradecraft, the target selection, and the people were the durable parts, and only one of those three was ever visible on a leak site.
This is why threat intelligence organized around behaviour outlives intelligence organized around branding, and it's the same conclusion the ransomware ecosystem keeps producing. When a group disappears, the sensible assumption is redistribution rather than retirement, and the practical follow-up question is which payload the same tradecraft appears behind next. For anyone in education, healthcare, or local government, that question is more useful than knowing whether Vice Society is still out there, because the answer determines what shows up next term.