Vectra

Vectra is the operator and developer of VectraRAT, a rental-only malware-as-a-service platform for Windows systems. Previously known as Nyxel, Vectra markets subscriptions that provide customers access to a Linux-based control server, Windows implant, payload builder, and support channel while retaining the platform source code. The actor has advertised the service through Russian-speaking cybercrime forums and Telegram; a Mandarin-language development environment has been suggested by technical artifacts, but Vectra's nationality is unconfirmed. VectraRAT combines remote-access and information-stealing functions. It supports hidden virtual-desktop access, remote command execution through Command Prompt and PowerShell, screen capture, keylogging, file transfer, process discovery, SOCKS5 proxying, browser-credential collection, and automated collection of network information and configuration files that may contain API keys or database connection strings. It can alter clipboard contents to hijack cryptocurrency addresses and includes an option to bypass UAC and obtain elevated execution without a user prompt. The platform uses a proprietary TCP-based command-and-control protocol and permits operators to redirect deployed implants to replacement control infrastructure. Observed distribution has included Amadey loader deployments and ClickFix social-engineering pages impersonating TurboTax that persuade victims to execute attacker-supplied commands. Victim telemetry showed confirmed file theft and a substantial proportion of affected systems running corporate Windows editions, including enterprise and server deployments. VectraRAT activity is associated with financially motivated malware-service operations rather than a confirmed state-sponsored intrusion set.