Vice Society is a relatively unknown cybercrime group that started operating a year ago. Over that year they have shown steady activity encrypting and exfiltrating victims’ data. Unlike other RaaS (Ransomware-as-a-Service) double extortion groups, Vice Society focuses on getting into the victim’s system to deploy ransomware binaries they bought on dark web forums. This is likely a way for the group to save resources in developing its own ransomware. Vice Society mainly targets small or middle-sized companies and does not restrict choosing their targets from government, healthcare, or critical infrastructure. According to Sekoia, 73.9% of known Vice Society victims are in France, the United States, the United Kingdom, Spain, Italy, Germany, and Brazil. Samples utilized by Vice Society include HelloKitty ransomware variants alongside modernized Zeppelin ransomware payloads. The group has chosen to maintain a relatively low profile, possibly to prevent attracting the attention of law enforcement agencies. They also have maintained a low profile by limiting the number of samples found in public repositories. CTIX continues to track threat actor activity worldwide and will provide additional updates accordingly.