Microsoft warns US healthcare of threat actor using new ransomware
Vanilla Tempest is now using INC, too.
· TechRadarNews By Sead Fadilpašić published 20 September 2024
Vanilla Tempest, a ransomware group also known as Vice Society, has been seen deploying the INC ransomware strain for the first time to target the American healthcare sector.
This is according to cybersecurity researchers from Microsoft, who recently detailed their newest findings in an X thread.
In the thread, the company said Vanilla Tempest first receives hands-off from Gootloader infections by Storm-0494, before deploying different malware and software, including Supper, AnyDesk, MEGA, and others.
Vice Society
The group uses Remote Desktop Protocol (RDP) for lateral movement, and Windows Management Instrumentation Provider Host to deploy the INC ransomware.
Unfortunately, Microsoft did not say which organizations Vanilla Tempest targeted, or how successful it was. Ransomware attacks against healthcare firms usually result in the leak of highly sensitive medical data, as well as potentially dizzying payouts.
Vanilla Tempest, or Vice Society, is a threat actor that’s been active since mid-2022. It usually targets education, healthcare, IT, and manufacturing sectors, and is known for frequently switching between different encryptors. While affiliates usually stick to one or two encryptors, Vanilla Tempest was observed using BlackCat, Quantum Locker, Zeppelin, Rhysida, and others.
In October 2022, Microsoft warned about Vanilla Tempest, saying it was known for swapping ransomware payloads as it targeted schools in the US. In some cases, Microsoft added, the group skips the encryption part altogether and just steals the data.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Contact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsors