Hello Kitty

Hello Kitty is a ransomware family, also referred to in the provided reporting as Hello Kitty/Five Hands. The content links it primarily to use by the Vice Society threat actor, which has repeatedly been described as deploying third-party ransomware strains rather than relying on a unique locker of its own. Vice Society has used Hello Kitty/Five Hands alongside other families such as Zeppelin, Rhysida, RedAlert, BlackCat, Quantum Locker, and INC in attacks. Reporting cited in the content states that Vice Society first appeared in summer 2021 and disproportionately targeted the education sector, especially K-12 institutions, while other reporting also associates the actor with attacks on healthcare and manufacturing organizations. The group’s intrusions involved exploitation of internet-facing applications and compromised valid accounts for initial access, with some reporting specifically noting exploitation of the PrintNightmare vulnerabilities CVE-2021-1675 and CVE-2021-34527 for privilege escalation. Associated tradecraft included network exploration and data exfiltration for double extortion, lateral movement using SystemBC, PowerShell Empire, Cobalt Strike, WMI, and tainted shared content, persistence via scheduled tasks and registry autostarts, DLL side-loading, masquerading, process injection, and sandbox evasion. The content also notes that Hello Kitty was among the ransomware variants most likely to re-extort victims in 2021 and that it held 5.4% market share in Q3 2021 ransomware attacks. Separately, the content states that former Conti members later infiltrated or took over multiple operations including Hello Kitty.