Loading story…
Researchers reported that VECT 2.0 ransomware can permanently damage files through flaws in its own encryption and decryption logic, leaving victims unable to restore data even if they receive the attackers’ decryptor. Analysis of the Windows variant found that the malware appends the .vect extension, targets a wide range of business files on 64-bit systems, and stores too little recovery metadata to reliably reconstruct what happened to each file. Implementation defects reportedly include lost encryption material for large files, buffer-size mismatches affecting mid-sized files, and race conditions caused by shared global buffers across worker threads, resulting in files that may be only renamed, partially encrypted, or structururally corrupted.
Separate reporting describes VECT as a double-extortion ransomware-as-a-service operation with support for Windows, Linux, and VMware ESXi, using lateral movement, defense evasion, shadow-copy deletion, and safe-mode reboot techniques before encryption. The group is linked in reporting to TeamPCP and possible overlaps with Devman, with alleged access from earlier supply-chain compromises involving Trivy, Checkmarx KICS, LiteLLM, and Telnyx feeding later intrusions. Because a critical flaw in VECT’s ChaCha20-based intermittent encryption can render large-file data unrecoverable, defenders are being urged to treat VECT incidents as both ransomware and destructive data-loss events rather than assuming payment will enable recovery.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Reporting cited by SOCRadar says TeamPCP carried out supply chain compromises in March 2026 affecting Trivy, Checkmarx KICS, LiteLLM, and Telnyx. The stolen credentials and upstream access from those incidents were allegedly used in later Vect intrusions.
Morphisec analyzed the Windows VECT 2.0 ransomware strain and found implementation flaws that can permanently damage files, including loss of encryption material for large files, buffer-size mismatches, and race conditions across worker threads. The findings indicate victims may be unable to recover data even with the attackers' own decryptor.
SOCRadar reports that the Vect ransomware-as-a-service operation emerged on a Russian-language cybercrime forum on December 31, 2025, offering low-cost affiliate access and later expanding through recruitment arrangements with BreachForums.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers have identified **Vect** as a new ransomware-as-a-service operation advertising a purportedly custom-built C++ locker for **Windows, Linux, and VMware ESXi**. The group began recruiting affiliates on a Russian-language cybercrime forum and promotes features including **ChaCha20-Poly1305** encryption, intermittent encryption for faster impact, Safe Mode execution, SMB and WinRM propagation, GPO-based deployment, and built-in packing or crypter functionality. Vect also operates **TOR-only** infrastructure for affiliate onboarding, victim communications, and leak-site publishing, and appears to follow a **double-extortion** model. The group has publicly claimed two victims in **Brazil** and **South Africa**, although neither the intrusions nor the full malware capabilities have been independently verified. Researchers said Vect shows unusually strong operational maturity for a newly observed crew, citing Monero payments, TOX communications, and a revenue-sharing model that waives entry fees for CIS-based affiliates while charging non-CIS applicants. Reporting suggests the operators may be experienced ransomware actors or a rebrand, and defenders were urged to harden exposed **RDP/VPN** and edge appliances such as Fortinet interfaces, segment management networks, watch for Safe Mode abuse and intermittent encryption, and strengthen anti-ransomware controls.
Jul 2, 2026
Researchers reported that **Payload** is a newly observed ransomware strain targeting Windows environments and rapidly expanding its operations, with about 50 victims listed on its leak site by late March. The malware appends the `.payload` extension to encrypted files and drops a ransom note named `RECOVER_payload.txt`, while focusing on sectors where downtime can quickly drive extortion pressure, including logistics, transportation, construction, real estate, manufacturing, and technology. Technical analysis indicates Payload uses a mature cryptographic design built on per-file **Curve25519 ECDH** key exchange and **ChaCha20** encryption, making recovery without the operators’ private key effectively infeasible. The ransomware also uses aggressive anti-forensics and disruption tactics before encryption, including deleting shadow copies, clearing Windows Event Logs, patching ETW-related functions in `ntdll`, terminating processes, and stopping backup and database services. Separate reporting on **Vect** highlighted a contrasting trend in the ransomware ecosystem: although Vect marketed enterprise-focused cross-platform ransomware for Windows, Linux, and ESXi, researchers found a critical cryptographic flaw that irreversibly destroys files larger than 128 KB, effectively turning many attacks into data wiping events even if victims pay. Together, the findings show a split between technically competent operators such as Payload and poorly engineered ransomware like Vect that can still cause severe business disruption.
Jun 29, 2026
Incident responders at **Coveware** reported a critical implementation flaw in the **Nitrogen** ransomware variant targeting **VMware ESXi**: the malware encrypts victim files using a **corrupted Curve25519 public key**, meaning the corresponding private key does not exist and **even the threat actor cannot decrypt** affected data. As a result, victims without viable backups are unlikely to recover encrypted ESXi systems, and **paying a ransom will not yield a working decryptor**. Technical analysis attributes the failure to a stack-variable overlap in the ESXi encryptor: the public key is placed at `rsp+0x20`, but a subsequent `QWORD` write at `rsp+0x1c` overwrites the first four bytes of that key, breaking the public/private key relationship required to derive the shared secret used for file encryption (Curve25519 key exchange feeding a **ChaCha8** key). Reporting also notes Nitrogen has operated since 2023 and is assessed to be derived from the leaked **Conti 2** builder code, consistent with multiple Conti-based ransomware offshoots.
Jun 29, 2026