However, it is quite possible, from the use of the data synchronization tool MEGASync, that the threat actor went straight after extortion without making any encryption at all. The tool is used by the affiliates for data exfiltration and is part of the INC ransomware kit. “In several cases, Microsoft assesses that the group did not deploy ransomware and instead possibly performed extortion using only exfiltrated stolen data,” Microsoft has said in an Oct 2022 blog.
A frequent public sector offender
Vanilla Tempest, also tracked as DEV-0832 and Vice Society, is a known offender of the education and healthcare sector. Additionally, the threat actor was often observed targeting the manufacturing industry.
Active since June 2021, the group has used multiple ransomware families, including BlackCat, Quantum Locker, Zeppelin, and Rhysida, and typically uses PowerShell scripts in their attacks.
