Vect ransomware

Initial Access Valid Accounts: Stolen/weak credentials T1078

Enters via exposed RDP/VPN or stolen credentials.

The two groups announced a formal operational partnership in late March 2026 to combine TeamPCP’s credential harvesting and data theft capabilities with Vect’s ransomware deployment infrastructure in a widespread campaign involving supply chain attacks...

Phishing Possible vulnerable external endpoint.

It uses New-CimSession to interact directly with WMI over WinRM.

Persistence Scheduled Task/Job (inferred) T1053

Instead, the module remotely registers Scheduled Tasks over CIM sessions... the task and CIM session are removed within 500 milliseconds, cleaning up artifacts on the target machine.

Execution Command and Scripting Interpreter T1059

WinRM - drops and remotely executes the payload via Invoke-Command over a WinRM session... analysis of the PowerShell script generated at runtime...

Persistence Scheduled Task/Job (inferred) T1053

Instead, the module remotely registers Scheduled Tasks over CIM sessions... the task and CIM session are removed within 500 milliseconds, cleaning up artifacts on the target machine.

Initial Access Valid Accounts: Stolen/weak credentials T1078

Enters via exposed RDP/VPN or stolen credentials.

Persistence Scheduled Task/Job (inferred) T1053

Instead, the module remotely registers Scheduled Tasks over CIM sessions... the task and CIM session are removed within 500 milliseconds, cleaning up artifacts on the target machine.

Initial Access Valid Accounts: Stolen/weak credentials T1078

Privilege Escalation Access Token Manipulation (inferred) T1134

A “GPO Credentials” field allows affiliates to input Domain Admin credentials directly into the payload builder, enabling automatic distribution via Group Policy Objects without external scripts. This significantly streamlines mass deployment across Windows domains.

The sample implements obfuscated strings to hinder analysis. Rather than storing plaintext strings for commands and data, it keeps them as encrypted bytes that are assembled and decoded at runtime using rotating XOR.

Built-in Evasion: A “VM Crypter/Packer” toggle standardizes anti-analysis techniques, protecting binaries from immediate signature detection by security tools.

After execution, the task and CIM session are removed within 500 milliseconds, cleaning up artifacts on the target machine.

Initial Access Valid Accounts: Stolen/weak credentials T1078

Privilege Escalation Access Token Manipulation (inferred) T1134

Built-in Evasion: A “VM Crypter/Packer” toggle standardizes anti-analysis techniques, protecting binaries from immediate signature detection by security tools.

A “GPO Credentials” field allows affiliates to input Domain Admin credentials directly into the payload builder, enabling automatic distribution via Group Policy Objects without external scripts. This significantly streamlines mass deployment across Windows domains.

Likely achieved through: credential dumping/harvested creds existing admin access from initial compromise

built-in LAN scanning for network reconnaissance via DFS and SMB protocols

Discovery System Information Discovery T1082

Identifies: file servers, shares, backups virtualisation storage (VHD/VMDK) critical services to kill

Built-in Evasion: A “VM Crypter/Packer” toggle standardizes anti-analysis techniques, protecting binaries from immediate signature detection by security tools.

The Windows tab allows the affiliate to exclude file extensions and paths as well as provide GPO credentials for compromise and spread through Active Directory environments.

RDP - copies itself to each domain computer, then stores credentials via cmdkey

Moves across the network using: SMB admin shares (ADMIN$, C$) remote execution

automated lateral movement through both SMB-based propagation and Windows Remote Management (WinRM) exploitation

The Windows tab allows the affiliate to exclude file extensions and paths as well as provide GPO credentials for compromise and spread through Active Directory environments.

Steals sensitive data before encryption: victim records, PII, internal docs

Recon + Targeting Identifies: file servers, shares, backups

Command-and-Control Application Layer Protocol: Web T1071.001

Command-and-Control Encrypted Channel: TOR T1573

Exfiltration Exfiltration Over C2 Channel T1041

A fourth download option for an exfiltration-only binary lacking encryption functionality was listed.

Encrypts using ChaCha20-Poly1305 (reported) Likely multi-threaded → fast network-wide impact

Vect kills anything that blocks file access or enables recovery: databases: SQL/MySQL/Oracle backup tools: Veeam/Commvault/Acronis security tooling / monitoring agents

Runs commands like: vssadmin delete shadows /all /quiet wbadmin delete catalog -quiet Purpose: ensure no easy restore path.

TeamPCP partnered with established extortion groups to monetize what they had taken. The Lapsus$ group added Checkmarx to its leak site... TeamPCP itself publicly boasted of plans to chain these compromises into ransomware campaigns.

Defence Evasion Impair Defences: Disable Tools T1562.001

Forces the infected system into Safe Mode before encryption to weaken EDR. Typical boot modification: bcdedit /set {default} safeboot network