Loading threat actor…
Vexy Ransomware, also known as Vexy, is a threat actor associated with reported ransomware incidents affecting geographically dispersed organizations across multiple sectors. Reported activity spans at least September–October 2026, with victims in India, the United States, Brazil, Argentina, France, the United Kingdom, Italy, Japan, Kenya, and Vietnam. Its reported victim base includes IT consulting firms, cloud and hosting providers, managed service providers, telecommunications businesses, retailers, manufacturers, an insurance broker, a public university, a real-estate business, and an industrial wastewater-treatment operator. Named victims include Data-Core Systems, i2k2 Networks, Logar Network Solutions, Strad Solutions, Groupe Proxitel, Majani Insurance Brokers, and Quy Nhon University. The actor's country of origin, organizational structure, affiliations, and initial-access methods are not established. Specific encryption behavior, data exfiltration, extortion mechanisms, and ransomware-as-a-service relationships have not been substantiated.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
1 indicator attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.