susvsex
susvsex is a malicious Visual Studio Code extension that was discovered in the official Visual Studio Marketplace in November 2025. It was identified by Secure Annex founder and researcher John Tuckner and was described as having basic ransomware and data-stealing capabilities. The extension was uploaded on November 5, 2025, by the publisher account "suspublisher18" and was removed from the marketplace by November 6, 2025.
Based on the reported behavior, susvsex is designed to auto-activate on essentially any event, including installation or VS Code launch. It invokes a function named "zipUploadAndEncrypt," which creates a ZIP archive of a target directory, exfiltrates that archive to a remote server, and then replaces the original files with encrypted versions. Reported target paths include C:\Users\Public\testing on Windows and /tmp/testing on macOS. The extension was also reported to use a private GitHub repository as its command-and-control channel, polling index.html for commands and writing results to requirements.txt. Reporting further stated that the package included decryption tools, C2 server code, and GitHub access keys, and that one associated GitHub account, "aykhanmv," claimed to be from Baku, Azerbaijan.
High-confidence capabilities directly described in the source material include automatic execution, file collection and ZIP archiving, exfiltration, file encryption for potential extortion, and GitHub-based C2. The available content does not attribute susvsex to a known threat actor beyond the uploader and associated GitHub account identifiers.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
susvsex is a malicious Visual Studio Code extension with ransomware and data-stealing capabilities, distributed via the official Visual Studio Marketplace.
Malicious Visual Studio Code extension with basic ransomware capabilities. It zips, exfiltrates, and encrypts files from a target directory, using GitHub as command-and-control. The extension can be updated to target other directories and included decryption tools and C2 server code by accident.
A Visual Studio Code extension that acts as ransomware, encrypting files in a target directory, exfiltrating the encrypted data to an attacker-controlled server, and using GitHub as a command and control channel. It includes hardcoded decryption keys and tools, and is a proof-of-concept or early-stage ransomware targeting developer environments.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.