A recent joint alert from the Cybersecurity & Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and Multi-State Information Sharing & Analysis Center (MS-ISAC) warned of an expanding threat organization traced as Vice Society. This warning comes days after the Los Angeles Unified School District was reportedly hit with a massive ransomware attack over Labor Day weekend, which Vice Society has claimed responsibility for. Vice Society is a known double extortion group that has been around for just over a year. In that time, Vice Society threat actors have deployed modified versions of Hello Kitty and Zeppelin ransomware variants, exploited PrintNightmare vulnerabilities CVE-2021-1675 & CVE-2021-34527, and targeted education institutions with ransomware attacks. Typically, these threat actors will initially exploit public-facing applications, preform network reconnaissance, and escalate privileges gaining access to domain administrator accounts. Additionally, Vice Society actors will deploy payloads configured to change credentials of network accounts to restrict remediation efforts. While most threat groups hesitate when claiming responsibility for exploiting education institutions, Brett Callow states “they seem to be Vice Society’s primary targets”. CTIX will continue to monitor activity the of Vice Society and other threat organizations worldwide and provide additional updates accordingly.