‘Ruthless’ Vice Society claims responsibility for Spar attack

Ransomware gang Vice Society has claimed duty for an attack that shut down card payment machines in 600 British isles branches of the Dutch supermarket chain Spar. It is the newest in a string of hacks claimed by the gang, which has been famous for its willingness to target crucial public infrastructure such as schools and hospitals.

Vice Society and the Spar hack

Final month, a ransomware attack on James Corridor and Corporation, which provides wholesale and IT products and services to Spar in the British isles, took down card machines in 600 outlets and compelled some to close their doorways.

At the conclusion of December, Vice Society claimed duty for the attack on its homepage on the dark net. The group detailed its “partners” as “Spar, James Corridor and Corporation and Heron and Brearly,”  the latter becoming Spar’s other wholesale providers in the British isles and Isle of Male.

While there is small depth of the hack by itself, the reality that stolen info has reportedly appeared on the dark net indicates that no ransom was paid, suggests Steve Forbes, head of cyber products at Nominet. “Spar definitely experienced good continuity plans in spot that enabled it to retain the relaxation of the company managing,” adds Forbes, noting that only a handful of branches experienced to close.

What is Vice Society?

Vice Society was to start with noticed carrying out attacks in mid-2021, and the gang has been famous for its ruthless conduct. “They do not seem to be to have any ethics or morals in conditions of who they are targeting,” suggests Forbes. The group has claimed duty for attacks on various university districts, like the Manhasset Union No cost College District in Extended Island and healthcare providers such as the United Health and fitness Centers of San Joaquin Valley, California.

Vice Society appears to possess a superior level of specialized skill, with its malware becoming capable to keep on being in units undetected. “We have observed them becoming careful to disable and wipe technique logs to enable hide their traces in the course of their attacks” describes Martin Lee, specialized direct of stability exploration at stability company Cisco Talos.

The group’s prior attacks may possibly get rid of some light-weight on how the Spar hack was executed, suggests Forbes. “There’s absolutely the indication that they’ve applied the PrintNightmare vulnerability, that appears to be to be their default process of entry,” he suggests.

The PrintNightmare vulnerability is a Home windows print spooler remote code execution vulnerability that appeared in the 2nd fifty percent of 2021. “Vice Society is a person of a little variety of ransomware groups who have been observed working with the PrintNightmare vulnerability from early August 2021,” suggests Chris Morgan, senior cyber threat intelligence analyst at stability company Electronic Shadows. “The group takes advantage of the exploit to attain additional privileges at the time they have compromised a target’s community. We can only believe that is what has transpired in (the case of Spar) as very well.”

Whilst Vice Society was to start with noticed by researchers final 12 months, it is considered to be strongly linked to an proven ransomware group termed HelloKitty, and could even be a reincarnation of the group. HelloKitty has been lively as lately as December, and the FBI thinks the gang is centered in Ukraine.

“They [Vice Society] are allegedly joined to the HelloKitty ransomware group, centered on similarities with some of their encryption modules,” Electronic Shadows’ Morgan suggests. Forbes agrees: “I know they’ve been joined to HelloKitty due to the fact they have very very similar equipment and processes that they use to infiltrate networks and to distribute laterally,” he adds.

Reporter

Claudia Glover is a staff reporter on Tech Observe.