Vanilla Tempest

Also known as Rapid Brigantine, Vice Society, Vice Spider, DEV-0832, INC Ransomware

Reports

First seen

Nov 1

Last seen

Jun 16

Motivation

financial, financially motivated

Targeting

Sectors

other ×5

Top ATT&CK techniques

T1486 Data Encrypted for Impact ×4T1566.002 Phishing: Spearphishing Link ×4T1027 Obfuscated Files or Information ×3T1190 Exploit Public-Facing Application ×2T1204 User Execution ×2T1140 Deobfuscate/Decode Files or Information ×2T1036.005 Match Legitimate Name or Location ×2T1036 Masquerading ×2T1566 Phishing ×2T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder ×2T1070.001 Indicator Removal: Clear Windows Event Logs ×2T1598 Phishing for Information ×2

Indicators

url ×65filename ×30hash_sha256 ×11ip_v4 ×8domain ×6cve ×3hash_sha1 ×2

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2021-26829 (exploited)CVE-2025-27915 (exploited)CVE-2025-41244 (exploited)

Recent reports

High

ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures

The Hacker NewsJun 16 Critical

Microsoft Disrupts Fox Tempest Malware-Signing Service Used for Ransomware Distribution

The Hacker NewsMay 20 Critical

Microsoft disrupts malware-signing-as-a-service operation abused by ransomware gangs

Bleeping ComputerMay 19 Critical

Cyber Brief October 2025 – Espionage, Disruption, Data Breaches, and Supply Chain Threats

CERT-EU Threat IntelNov 1

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.