Loading malware…
Vect is a financially motivated ransomware-as-a-service operation that emerged in late 2025 and became active in early 2026. It is associated with a double-extortion model in which victim data is stolen and victims are then pressured through encryption and leak-site publication. The malware family is described as a custom C++ locker supporting Windows, Linux, and VMware ESXi environments, with affiliate-oriented infrastructure including a negotiation portal, leak site, and broad affiliate recruitment.
Vect includes enterprise-focused functionality such as process termination, shadow-copy and recovery inhibition, Safe Mode boot manipulation on Windows, and cross-network propagation features. Reported capabilities include LAN scanning and lateral movement through SMB and WinRM, with additional support for remote execution and deployment across domain environments. The malware has been advertised for use against virtualized infrastructure and can target virtual disk data alongside conventional enterprise files.
Public reporting links Vect to an operational partnership with TeamPCP in 2026. In that model, TeamPCP harvested credentials and access through software supply-chain compromises and Vect provided downstream ransomware deployment and extortion infrastructure. At least one verified Vect deployment has been reported using TeamPCP-sourced credentials. This partnership reflects a credential-theft-to-extortion pipeline in which compromised CI/CD and developer environments are monetized later through ransomware operations.
Technical analysis of Vect 2.0 identified a severe cryptographic implementation flaw affecting files larger than 128 KB across Windows, Linux, and ESXi variants. Because the malware mishandles encryption nonces during chunked encryption, many affected files become permanently unrecoverable even by the operators. As a result, incidents involving Vect can behave operationally like destructive wiper events rather than recoverable ransomware cases. Additional analysis has characterized parts of the codebase as immature or poorly implemented despite the surrounding criminal infrastructure appearing comparatively organized.
Vect should therefore be regarded as both an extortion threat and a destructive malware risk. Organizations exposed to intrusions attributed to Vect, especially where access may derive from stolen credentials or prior supply-chain compromise, face risks including data theft, broad encryption impact, recovery inhibition, and irreversible data loss.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
TeamPCP exploited CVE-2026-33634 to overwrite 76 of 77 versions of Trivy’s automated workflow, a container scanning tool, using a stolen developer credential with write access to the repository.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Direct fetches of the ransomware.live Vect tracker show the victim count unchanged at 25 ... Combined with the earlier Check Point disclosure of a cryptographic flaw in Vect 2.0, this reinforces the prior assessment that TeamPCP is currently monetizing through supply chain credential theft rather than affiliate ransomware.
The current pause, combined with the Vect ransomware affiliate announcement, suggests TeamPCP has shifted primary operational focus from supply chain expansion to monetization of existing credential harvests.
Check Point researchers opened a BreachForums account, got access to the panel and ransomware builder, and analyzed the gang's malware. They quickly determined that the ransomware-as-a-service group also isn't very good at writing code ... and they appear to have accidentally written a data wiper. Instead of encrypting large files ... Vect 2.0 ransomware permanently destroys any files larger than 131,072 bytes (128 KB).
31 distinct techniques documented for this family, organized by ATT&CK tactic.
VECT’s operators buy their way in using stolen credentials harvested from tampered open source software rather than scanning networks for weaknesses.
Vect operators retain alternative initial access paths, including compromised Fortinet credentials solicited on a Russian-language forum in January 2026, plus base64-encoded credentials supplied at build time or via the –creds parameter for RDP and VPN abuse.
Between February and March 2026, TeamPCP tampered with four widely used open source packages that development teams rely on daily.
Between March 19 and March 24, 2026, TeamPCP compromised the Trivy GitHub Actions workflow, the Checkmarx KICS package, the LiteLLM PyPI distribution (versions 1.82.7 and 1.82.8), and the Telnyx Python SDK. A credential-harvesting payload fired during CI/CD execution in downstream organizations.
The function labeled “GPO spread” performs no Group Policy operations. It registers Scheduled Tasks remotely over CIM sessions, each named with a hardcoded “DM” prefix followed by four random uppercase letters.
The function labeled “GPO spread” performs no Group Policy operations. It registers Scheduled Tasks remotely over CIM sessions, each named with a hardcoded “DM” prefix followed by four random uppercase letters.
VECT’s operators buy their way in using stolen credentials harvested from tampered open source software rather than scanning networks for weaknesses.
Vect operators retain alternative initial access paths, including compromised Fortinet credentials solicited on a Russian-language forum in January 2026, plus base64-encoded credentials supplied at build time or via the –creds parameter for RDP and VPN abuse.
The function labeled “GPO spread” performs no Group Policy operations. It registers Scheduled Tasks remotely over CIM sessions, each named with a hardcoded “DM” prefix followed by four random uppercase letters.
A double XOR routine intended to keep these flags encrypted at rest accidentally cancels itself out, leaving them as plaintext strings inside the binary.
Built-in LAN scanning enables automated network reconnaissance following initial access.
The Linux and ESXi variants implement CIS geofencing by reading LANG, LC_ALL, and /etc/timezone.
Impact Data Destruction T1485 Implementation defects can irreversibly corrupt files, producing a wiper-like effect regardless of intent.
Impact Data Encrypted for Impact T1486 Operates as ransomware, encrypting victim files for extortion.
The locker then terminates a hardcoded list of security agents ... backup engines ... database services
22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
44 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware used for downstream extortion and deployment after TeamPCP-sourced credential theft; described as part of a credential-to-extortion pipeline.
Ransomware whose operators leverage stolen credentials harvested via tampered open source software, allowing them to select victims from a pre-existing credential archive instead of conducting traditional reconnaissance or direct exploitation.
A ransomware-as-a-service operation that deploys ransomware and is collaborating with TeamPCP to turn stolen credentials from supply-chain compromises into ransomware attacks.
A ransomware-as-a-service operation whose latest version reportedly had a faulty encryption process that destroyed files larger than 128 KB, rendering them unrecoverable.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.