Vect

Vect is a financially motivated, Russian-speaking ransomware-as-a-service operation that emerged in late 2025 and rapidly expanded through aggressive affiliate recruitment and partnerships in the cybercrime ecosystem. The group operates a double-extortion model, combining data theft and public leak-site pressure with ransomware deployment against Windows, Linux, and VMware ESXi environments. Vect is commonly referred to as Vect or VECT. Vect became notable in 2026 for formal collaboration with TeamPCP, a separate cybercriminal group associated with large-scale software supply-chain compromises and credential theft from CI/CD, developer, and cloud environments. In this division of labor, TeamPCP appears to function as an upstream access and data supplier, while Vect provides ransomware deployment and extortion monetization. Reporting indicates that credentials and access harvested through compromises involving Trivy, Checkmarx KICS, LiteLLM, and the Telnyx Python SDK were later used to support Vect victimization, and at least one Vect deployment has been credibly linked to TeamPCP-sourced access. Victim claims tied to this pipeline have included organizations allegedly exposed through the Trivy and LiteLLM campaign, though not all public claims are independently confirmed. Vect has also been associated with BreachForums-based affiliate enablement, including unusually broad distribution of affiliate access, suggesting an effort to industrialize ransomware operations and lower barriers to entry for less experienced criminals. The group’s business model has been described as offering high profit shares to affiliates and integrating forum-driven recruitment, escrow, and negotiation support. Technically, Vect uses purpose-built ransomware tooling written in C++ rather than commodity leaked builders, with support for cross-platform encryption operations. Observed tradecraft includes disabling or impairing security controls, terminating security, backup, database, and productivity processes, deleting shadow copies, manipulating Safe Mode boot settings, enumerating network shares and trust relationships, and moving laterally through common administrative mechanisms such as SMB, WinRM, WMI, DCOM, remote services, scheduled tasks, and SSH. Vect’s operators and affiliates rely on separate tooling or pre-stolen data for exfiltration in some intrusions, rather than a dedicated built-in exfiltration component. Multiple analyses have noted overlaps between Vect and Devman, including similarities in ransom-note style, builder strings, and lateral-movement task naming conventions. This may indicate a rebrand, spinoff, shared developers, or deliberate imitation, but the exact relationship remains unconfirmed. A significant operational characteristic of Vect is a serious flaw in its encryption implementation. Independent reporting has indicated that the ransomware can irreversibly damage many larger files, making some incidents functionally closer to destructive wiper activity than recoverable ransomware. As a result, payment does not reliably imply restoration capability. Overall, Vect represents an emerging ransomware ecosystem actor distinguished less by novel intrusion tradecraft than by its integration with upstream access brokers and supply-chain compromise operators, especially TeamPCP. Its role in converting mass credential theft and software supply-chain compromise into downstream extortion and ransomware deployment makes it a notable example of increasingly specialized, collaborative cybercrime operations.