Vice Society
A ransomware-as-a-service crew active 2021-2023, widely regarded as the predecessor to Rhysida.
Last refreshed: 20 May 2026 · Appears in 1 active topic
Vice Society became Rhysida; is the same crew now targeting German state capitals?
Timeline for Vice Society
Rhysida names Stuttgart on leak site
Cybersecurity: Threats and Defences- What happened to the Vice Society ransomware group?
- Vice Society wound down in 2023 as its operators transitioned to the Rhysida ransomware-as-a-service platform. Rhysida is considered Vice Society's operational successor, sharing tooling, affiliate model, and targeting preferences for public-sector institutions.Source: Unit 42 / SentinelOne
- Is Vice Society related to Rhysida ransomware?
- Yes. Security researchers assess Rhysida as Vice Society's direct successor. Both crews use double-extortion, target public-sector institutions with legacy IT environments, and share infrastructure and affiliate patterns. Vice Society was active 2021-2023; Rhysida launched as its replacement.Source: Cybersecurity research community
Background
Vice Society was a ransomware-as-a-service crew active from approximately 2021 to 2023, broadly regarded as the operational predecessor to the Rhysida group. Vice Society focused primarily on education and healthcare targets, with significant attacks against school districts in the United States and NHS-linked healthcare providers in the United Kingdom. The crew used double-extortion tactics: encrypting victim systems and threatening to publish exfiltrated data on its leak site if ransom payments were not made.
Vice Society dissolved or transitioned in 2023 as its operators shifted infrastructure and branding to the Rhysida ransomware-as-a-service platform. Rhysida inherits Vice Society's affiliate model, targeting preference for public-sector institutions with complex legacy IT, and double-extortion methodology. Security researchers at Unit 42 and SentinelOne documented the operational continuity between the two crews based on shared tooling, infrastructure patterns, and affiliate communications.
Vice Society is now primarily significant as context for understanding Rhysida's lineage and tradecraft. The education and healthcare targeting template established under Vice Society persists into Rhysida operations, with Rhysida expanding to include government targets including the British Library (2023) and Landeshauptstadt Stuttgart (May 2026).
