Ransomware group profile · #35 by claimed victims

Vicesociety ransomware

Vice Society ransomware appends the .v-society extension when encrypting Linux machines. Running a leak site on the darkweb, Possible relations with "HelloKitty"

Active First seen May 2021

188Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

22Countries hit

8Leak-site URLs tracked, 0 online

20 Jun 2023Latest claim recorded

Victimology

Who Vicesociety claims to have breached, from 188 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Education64

Manufacturing17

Government & Defense17

Healthcare17

Professional Services13

Technology11

Financial Services10

Retail & E-Commerce9

Top countries

United Kingdom7

United States7

Spain3

Germany3

Australia3

Indonesia2

Sweden1

Philippines1

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
SSV Architects ssv-architekten.de	Professional Services	DE	20 Jun 2023
Bogleboo bogleboo.se	Technology	SE	13 Jun 2023
Nerim nerim.com	Technology	—	4 Jun 2023
Adsboll ads.dk	Retail & E-Commerce	DK	29 May 2023
Cafpi cafpi.fr	Financial Services	FR	22 May 2023
Aneka Tambang antam.com	Energy & Utilities	ID	17 May 2023
DATALAN datalan.sk	Technology	SK	11 May 2023
Brighton Hill Community School brightonhill.hants.sch.uk	Education	GB	2 May 2023
CMC Group centurylabel.com	Manufacturing	—	30 Apr 2023
Neptune Lines neptunelines.com	Transportation	—	22 Apr 2023
Lakeland Community College lakelandcc.edu	Education	US	18 Apr 2023
CommScope commscope.com	Technology	—	15 Apr 2023

All 188 Vicesociety victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Vicesociety is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Vicesociety ransomware still active?

Vicesociety is tracked as active. The most recent leak-site claim VULONE recorded is dated 20 June 2023.

How many victims has Vicesociety claimed?

VULONE has recorded 188 leak-site victim claims attributed to Vicesociety since May 2021, across 22 countries and 14 sectors.

Which industries does Vicesociety target?

The sectors most often named on the Vicesociety leak site are Education, Manufacturing, Government & Defense.

Which countries are most affected by Vicesociety?

Most Vicesociety victims recorded by VULONE are located in United Kingdom, United States, Spain.

Where does VULONE get Vicesociety victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].