Netskope Threat Labs

Vicesociety

ATP Sandbox Adv. Heuristics

Vicesociety is a ransomware operation known for targeting healthcare and educational institutions, and its campaigns hit sectors where downtime endangers patients and disrupts entire communities. Its operators have used destructive attacks that skip encryption demands altogether, and they stole data and extorted victims through leak site threats before winding down activity. Researchers linked its tooling to several high profile incidents, and its behavior showed how some crews treat disruption itself as the objective.

First seen
January 2023
Last seen
October 2026
ViceSociety
Alert Name
Linux.Ransomware.ViceSociety
Win64.Ransomware.Vicesociety