Microsoft warns US healthcare of threat actor using new ransomware

Vanilla Tempest, a ransomware group also known as Vice Society, has been seen deploying the INC ransomware strain for the first time to target the American healthcare sector.

This is according to cybersecurity researchers from Microsoft, who recently detailed their newest findings in an X thread.

In the thread, the company said Vanilla Tempest first receives hands-off from Gootloader infections by Storm-0494, before deploying different malware and software, including Supper, AnyDesk, MEGA, and others.

Vice Society

The group uses Remote Desktop Protocol (RDP) for lateral movement, and Windows Management Instrumentation Provider Host to deploy the INC ransomware.

Unfortunately, Microsoft did not say which organizations Vanilla Tempest targeted, or how successful it was. Ransomware attacks against healthcare firms usually result in the leak of highly sensitive medical data, as well as potentially dizzying payouts.

Vanilla Tempest, or Vice Society, is a threat actor that’s been active since mid-2022. It usually ...