Vanilla Tempest

Vanilla Tempest, also known as Vice Society or DEV-0832, is a significant threat actor that has been increasingly active in the cybercrime landscape since 2022. This group primarily targets U.S. healthcare organizations and educational institutions, employing a variety of ransomware strains to execute their attacks. Their tactics include the use of PowerShell scripts and repurposed legitimate tools such as AnyDesk remote monitoring and management tool and the MEGA data synchronization tool. Recently, Microsoft warned that Vanilla Tempest has shifted its strategy, now utilizing INC ransomware, a malware from Russian-speaking INC Ransom, in their assaults on the healthcare sector. According to Microsoft Threat Intelligence, Vanilla Tempest receives handoffs from Gootloader infections by another threat actor, Storm-0494, before deploying tools and ransomware. The group also exploits publicly disclosed vulnerabilities for initial access and post-compromise elevation of privilege. In a new development, the FBI and CISA have reported that Vanilla Tempest affiliates associated with the Vice Society ransomware group have transitioned to using Rhysida ransomware payloads during their attacks, suggesting an evolution in their methods. The impact of Vanilla Tempest's activities has been disproportionately felt by the education sector in the United States. Since its inception, Vanilla Tempest has used at least five different malware strains, demonstrating a high degree of adaptability and sophistication. Fortunately, Microsoft Defender for Endpoint can detect multiple stages of Vanilla Tempest activity and the known INC ransomware and other malware identified in this campaign, providing some level of defense against this dynamic and evolving threat.