VECT (rebranded as VECT 2.0) is an emerging Ransomware-as-a-Service (RaaS) operation that first appeared in December 2025 and rapidly escalated operations through February 2026, targeting Windows, Linux, and VMware ESXi environments across technology, manufacturing, financial services, healthcare, business services, engineering services, education, real estate, forestry and lumber, banking, information technology, medicine, energy, accounting services, legal, retail, and professional services sectors worldwide. VECT ransomware gained rapid reach through a mass affiliate model on BreachForums and a strategic partnership with the TeamPCP supply chain threat group, dramatically lowering the barrier to entry for ransomware deployment.
The VECT ransomware is written in C++ and incorporates a critically flawed ChaCha20-IETF encryption implementation containing a nonce-handling bug that is shared across all three platform variants (Windows, Linux, VMware ESXi). Due to this fundamental cryptographic flaw in the VECT encryption engine, three of four decryption nonces are permanently discarded for every file exceeding 128 KB in size. Given that virtually all enterprise-critical data such as VM disks, databases, backups, and documents exceed this 128 KB threshold, VECT ransomware effectively operates as a destructive data wiper masquerading as ransomware rather than producing recoverable encrypted files.
VECT victims who pay the ransom demanded by attackers cannot recover their data even with the decryption key, as the flawed encryption implementation permanently destroys the information necessary for decryption of files larger than 128 KB. This critical flaw transforms VECT ransomware from a traditional extortion-based ransomware into an unintentional data destruction tool, compounded by exfiltration threats and a growing affiliate distribution network that continues to deploy the fundamentally broken encryption implementation across victim organizations.
VECT RaaS Operation and Distribution Model
VECT, now rebranded as VECT 2.0, is an emerging Ransomware-as-a-Service (RaaS) group that rapidly escalated its operations through February 2026 after first appearing in December 2025. The VECT threat group operates a custom-built C++ codebase targeting Windows, Linux, and VMware ESXi platforms and follows an explicit affiliate model to maximize disruption and financial gain across a broad range of industries and geographic regions.
VECT ransomware's initial access strategy is diverse and opportunistic, leveraging multiple entry vectors across its broad affiliate base including compromised credentials, exposed remote services such as RDP and VPN, and phishing campaigns. Most notably, VECT formed a partnership with TeamPCP, a threat group behind a series of supply chain attacks in early 2026 that injected malicious code into widely used developer tools including Aqua Security's Trivy, Checkmarx's KICS, LiteLLM, and Telnyx, giving VECT affiliates pre-existing access to a large pool of compromised enterprise environments through the TeamPCP supply chain compromise vector.
VECT ransomware also partnered with BreachForums, granting every registered member automatic access to its ransomware builder, negotiation platform, and leak site, dramatically lowering the barrier to entry overnight for aspiring ransomware operators. This BreachForums partnership enabled rapid distribution of VECT ransomware across a mass affiliate base with minimal technical expertise required to deploy the ransomware across victim organizations.
VECT Ransomware Execution and Impact Chain
Following initial access to victim environments, VECT ransomware executes a structured impact chain across all supported platforms (Windows, Linux, VMware ESXi). On Windows systems, the VECT locker enumerates all logical, removable, and network-mapped drives, terminates processes holding file locks to maximize the number of files that can be encrypted, and renames each targeted file with the '.vect' extension before applying the flawed encryption routine.
When the '--force-safemode' flag is active during VECT ransomware execution, it modifies the boot configuration via 'bcdedit' command to reboot the Windows system into Safe Mode. VECT writes its path to the Windows registry for automatic execution on the next boot, where most security products are inactive in Safe Mode, allowing the VECT ransomware to execute without interference from endpoint detection and response (EDR) or antivirus software.
Post-encryption cleanup activities by VECT ransomware include shadow copy deletion to prevent file recovery from Volume Shadow Copy Service, clearing the Windows event log to remove forensic evidence, removing PowerShell history to eliminate command-line artifacts, and executing a self-deletion script to remove the VECT ransomware binary from the compromised system. For lateral movement across the victim network, the Windows variant of VECT ransomware uses multiple encoded remote-execution script templates driven by operator-supplied credentials to spread the ransomware across the enterprise environment. The Linux and ESXi variants of VECT ransomware share substantially similar codebases and implement comparable subsets of this functionality.
Critical Encryption Flaw in VECT Ransomware
A fundamental flaw in VECT ransomware's encryption engine, present identically across all three platform variants (Windows, Linux, VMware ESXi), causes three of four decryption nonces to be permanently discarded for every file exceeding 128 KB in size. This critical cryptographic implementation error in the ChaCha20-IETF encryption routine means that the information necessary to decrypt the file is permanently lost during the encryption process, rendering the encrypted data irrecoverable even with possession of the correct decryption key.
Given that virtually all enterprise-critical files exceed the 128 KB threshold, including VM disks, databases, backups, documents, and most business-critical data, VECT ransomware functions in practice as a destructive data wiper rather than recoverable ransomware. Organizations that pay the VECT ransom demand cannot recover their data even after receiving the decryption key from the threat actors, as the flawed encryption implementation has permanently destroyed the nonce information required for successful decryption of files larger than 128 KB.
This fundamental cryptographic flaw transforms VECT ransomware from a traditional extortion-based ransomware into an unintentional data destruction tool, making payment of the ransom demand futile for recovery of encrypted data while still exposing victim organizations to the exfiltration and leak threats claimed by VECT operators.
VECT Ransom Demands and Affiliate Structure
VECT ransomware's ransom note claims exfiltration of sensitive data including databases, backups, and personal information to support double-extortion tactics; however, a dedicated exfiltration binary listed in the VECT affiliate panel was marked "coming soon" and unavailable at the time of security researcher analysis, suggesting that data exfiltration capabilities may not be fully implemented across all VECT ransomware deployments.
VECT ransom negotiations occur through a Tor hidden service, with a secondary contact available via Qtox encrypted messaging. Payments are enforced exclusively in Monero (XMR) cryptocurrency for financial anonymity and to complicate law enforcement tracking efforts. VECT affiliates receive an 80% commission share of ransom payments, tracked through a built-in earnings dashboard with a $1,000 minimum transfer threshold to incentivize high-value targeting and multiple victim deployments.
As of February 28, 2026, the VECT threat group's Tor-hosted Data Leak Site reported 20 active victim cases spanning manufacturing, education, healthcare, and technology sectors, with Brazil and the United States as the most heavily targeted countries in VECT ransomware campaigns.
Rotate Credentials on TeamPCP-Exposed Systems
Organizations that used Trivy, KICS, LiteLLM, or Telnyx in their development pipelines prior to March 2026 should treat those environments as potentially compromised by the TeamPCP supply chain attack. Immediately rotate all service account credentials, API keys, and privileged account passwords across systems that may have executed compromised versions of these developer tools, and audit for unauthorized access or persistence mechanisms that may provide VECT affiliates with ongoing access to the environment.
Monitor for Safe Mode Boot Tampering
Deploy detection rules to alert on bcdedit /set safeboot command execution and unexpected system reboots into Safe Mode, which VECT ransomware uses as a defense evasion mechanism to run its payload with security software disabled. Automated alerting on Safe Mode boot configuration changes provides early warning of active VECT ransomware execution before the encryption routine completes across the enterprise environment.
Monitor and Alert on Shadow Copy Deletion
Implement real-time alerts on vssadmin delete shadows commands and Windows VSS (Volume Shadow Copy Service) service termination events. Shadow copy deletion is a strong indicator of active ransomware execution and should trigger immediate incident response procedures to isolate affected systems before the VECT encryption routine can spread across network-mapped drives and lateral movement targets.
Harden SSH Access on Linux and ESXi Environments
Audit and remove unauthorized SSH public keys from all Linux and ESXi hosts that may be targets for VECT ransomware deployment. Enable SSH host key verification and restrict SSH access to explicitly approved management hosts only through firewall rules and access control lists, limiting the SSH-based lateral movement capability that VECT ransomware uses to spread across virtualization infrastructure and Linux server environments.
Restrict WMI, DCOM, and PowerShell Remoting
Limit WMI (Windows Management Instrumentation) and DCOM (Distributed Component Object Model) access to authorized management systems using Windows Firewall rules and network segmentation policies. Disable PowerShell remoting on hosts where it is not operationally required for legitimate administrative functions, and monitor for unusual remote execution originating from non-standard source systems that may indicate VECT lateral movement activity across the Windows domain environment.
Initial Access
Execution
Persistence
Defense Evasion
Privilege Escalation
Credential Access
Discovery
Lateral Movement
Collection
Command and Control
Exfiltration
Impact
SHA256 Hashes
Command and Control Infrastructure
File Names
File Extension
Contact Information
Recent VECT Ransomware Victims (partial list):
https://research.checkpoint.com/2026/vect-ransomware-by-design-wiper-by-accident/
https://www.dsci.in/files/content/advisory/2026/threat-report-feb-2026.pdf
https://www.threatlocker.com/blog/vect-ransomware-exposed-an-inside-look-at-its-affiliate-network
https://www.halcyon.ai/ransomware-alerts/emerging-ransomware-group-vect
