Loading malware…
Vect is a ransomware family distributed through a ransomware-as-a-service operation that emerged in late December 2025 and began claiming victims in January 2026. Its affiliate model combines file encryption with extortion and publication of victim data. The operation has targeted organizations across manufacturing, healthcare, education, information technology, and energy, with early victim claims spanning several countries.
The analyzed Windows locker uses libsodium’s ChaCha20-IETF cipher. It terminates security, backup, database, and productivity processes, disables Microsoft Defender protections and Task Manager, and deletes volume shadow copies to inhibit recovery. It supports Safe Mode execution and persistence, network-share enumeration, and credential-assisted lateral movement through Windows remote administration mechanisms, including WinRM, WMI, DCOM, scheduled tasks, and services.
Vect 2.0 contains serious encryption implementation defects. For files larger than 128 KB, it encrypts four separate regions using different nonces but preserves only the final nonce, leaving the earlier encrypted regions unrecoverable even with the correct key. A separate buffer-handling defect can leave some smaller files unencrypted despite modifying their metadata. These flaws make affected deployments potentially destructive rather than reliably reversible ransomware; ransom payment does not guarantee recovery.
In late March 2026, Vect announced an operational partnership with TeamPCP, also tracked as UNC6780, combining TeamPCP’s software-supply-chain credential harvesting and data theft with Vect’s ransomware infrastructure. At least one verified Vect deployment used TeamPCP-sourced credentials. The relationship enables downstream ransomware attacks against organizations whose developer, cloud, or automation credentials were exposed through compromised tooling, including Trivy and LiteLLM. Vect also partnered with BreachForums to recruit affiliates and distribute access to its ransomware platform. TeamPCP’s credential-stealing payloads are distinct from the Vect locker.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The article describes downstream extortion by "groups like Vect ransomware (TeamPCP)" and identifies Guesty and S&P Global on Vect's leak site.
The current pause, combined with the Vect ransomware affiliate announcement, suggests TeamPCP has shifted primary operational focus from supply chain expansion to monetization of existing credential harvests.
Check Point researchers opened a BreachForums account, got access to the panel and ransomware builder, and analyzed the gang's malware. They quickly determined that the ransomware-as-a-service group also isn't very good at writing code ... and they appear to have accidentally written a data wiper. Instead of encrypting large files ... Vect 2.0 ransomware permanently destroys any files larger than 131,072 bytes (128 KB).
56 distinct techniques documented for this family, organized by ATT&CK tactic.
TeamPCP's own Telegram channel states: "you may already know us as TeamPCP or Shellforce... CipherForce is a newer project we are starting to find affiliates."
CipherForce is a newer project we are starting to find affiliates... This means TeamPCP is running two parallel ransomware tracks simultaneously: their proprietary CipherForce program for direct operations, and the mass Vect affiliate program via BreachForums for distributed operations.
VECT’s operators buy their way in using stolen credentials harvested from tampered open source software rather than scanning networks for weaknesses.
Vect operators retain alternative initial access paths, including compromised Fortinet credentials solicited on a Russian-language forum in January 2026, plus base64-encoded credentials supplied at build time or via the –creds parameter for RDP and VPN abuse.
The vendor added that initial access is likely achieved via exposed RDP/VPN, stolen credentials, phishing or vulnerability exploitation.
TeamPCP compromised the telnyx Python SDK on PyPI, publishing malicious versions 4.87.1 and 4.87.2... the attacker used stolen PyPI credentials rather than a repository compromise.
TeamPCP provides initial access via compromised supply chain packages and stolen credentials, Vect provides encryption and extortion tooling, and BreachForums provides the operator base.
Between March 19 and March 24, 2026, TeamPCP compromised the Trivy GitHub Actions workflow, the Checkmarx KICS package, the LiteLLM PyPI distribution (versions 1.82.7 and 1.82.8), and the Telnyx Python SDK. A credential-harvesting payload fired during CI/CD execution in downstream organizations.
The vendor added that initial access is likely achieved via exposed RDP/VPN, stolen credentials, phishing or vulnerability exploitation.
Invoke-WmiMethod -ComputerName $pc -Credential $cred -Class Win32_Process -Name Create -ArgumentList "%ProgramData%\$name" -EA Stop
Or through scheduled tasks: $action=New-ScheduledTaskAction -Execute "%ProgramData%\$name" ... Register-ScheduledTask ... Start-ScheduledTask ... From scheduled tasks installed via the command line: schtasks /create /s $pc ...
The function labeled “GPO spread” performs no Group Policy operations. It registers Scheduled Tasks remotely over CIM sessions, each named with a hardcoded “DM” prefix followed by four random uppercase letters.
Execution is initiated through PowerShell, the Windows command shell, or a service installed remotely with sc.exe.
Execution is initiated through PowerShell, the Windows command shell, or a service installed remotely with sc.exe.
It enumerates accessible network shares with WNetOpenEnum and NetShareEnum, walks file systems with standard Win32 APIs, and probes domain trust relationships.
Execution is initiated through PowerShell, the Windows command shell, or a service installed remotely with sc.exe.
Or through scheduled tasks: $action=New-ScheduledTaskAction -Execute "%ProgramData%\$name" ... Register-ScheduledTask ... Start-ScheduledTask ... From scheduled tasks installed via the command line: schtasks /create /s $pc ...
The function labeled “GPO spread” performs no Group Policy operations. It registers Scheduled Tasks remotely over CIM sessions, each named with a hardcoded “DM” prefix followed by four random uppercase letters.
VECT’s operators buy their way in using stolen credentials harvested from tampered open source software rather than scanning networks for weaknesses.
if –force-safemode is set the locker writes SafeBoot Minimal and Network registry entries plus a Run key so the host reboots into safe mode with most endpoint protection inactive.
Vect operators retain alternative initial access paths, including compromised Fortinet credentials solicited on a Russian-language forum in January 2026, plus base64-encoded credentials supplied at build time or via the –creds parameter for RDP and VPN abuse.
Defense Evasion: The malware manipulates Windows Safe Mode boot settings to suppress security tooling... Configure SIEM alerting on bcdedit command execution and modifications to SafeBoot registry keys. These are known precursors to Vect ransomware execution.
if –force-safemode is set the locker writes SafeBoot Minimal and Network registry entries plus a Run key so the host reboots into safe mode with most endpoint protection inactive.
Or through scheduled tasks: $action=New-ScheduledTaskAction -Execute "%ProgramData%\$name" ... Register-ScheduledTask ... Start-ScheduledTask ... From scheduled tasks installed via the command line: schtasks /create /s $pc ...
The function labeled “GPO spread” performs no Group Policy operations. It registers Scheduled Tasks remotely over CIM sessions, each named with a hardcoded “DM” prefix followed by four random uppercase letters.
VECT’s operators buy their way in using stolen credentials harvested from tampered open source software rather than scanning networks for weaknesses.
if –force-safemode is set the locker writes SafeBoot Minimal and Network registry entries plus a Run key so the host reboots into safe mode with most endpoint protection inactive.
A double XOR routine intended to keep these flags encrypted at rest accidentally cancels itself out, leaving them as plaintext strings inside the binary.
The strongest attribution link across all TeamPCP operations is a shared RSA-4096 public key embedded in payloads -- search for this key in forensic artifacts from any suspected TeamPCP exposure.
Command line flags include –stealth (self-delete)
VECT’s operators buy their way in using stolen credentials harvested from tampered open source software rather than scanning networks for weaknesses.
On top of that, although the Windows variant implements environment detection mechanisms to fly under the radar... The ESXi variant, on the other hand, enforces geofencing and anti-debugging checks prior to commencing the encryption step.
The geofencing step verifies if it's running in a CIS country, and if so, exits without encrypting the files.
Defense Evasion: The malware manipulates Windows Safe Mode boot settings to suppress security tooling... Configure SIEM alerting on bcdedit command execution and modifications to SafeBoot registry keys. These are known precursors to Vect ransomware execution.
if –force-safemode is set the locker writes SafeBoot Minimal and Network registry entries plus a Run key so the host reboots into safe mode with most endpoint protection inactive.
Defense Evasion: The malware manipulates Windows Safe Mode boot settings to suppress security tooling and terminates security, backup, and database processes immediately prior to payload execution.
if –force-safemode is set the locker writes SafeBoot Minimal and Network registry entries plus a Run key so the host reboots into safe mode with most endpoint protection inactive.
The current pause, combined with the Vect ransomware affiliate announcement, suggests TeamPCP has shifted primary operational focus from supply chain expansion to monetization of existing credential harvests.
The locker stores affiliate-supplied credentials on each target host using cmdkey, which writes them into the Windows Credential Manager.
The current pause, combined with the Vect ransomware affiliate announcement, suggests TeamPCP has shifted primary operational focus from supply chain expansion to monetization of existing credential harvests.
It then enumerates hosts via AD: $pcs=@([adsisearcher]'objectCategory=computer').FindAll()|%{$_.Properties.dnshostname[0]}|?{$_ -and $_ -ne $env:COMPUTERNAME} | It then enumerates hosts via AD... Next, it copies itself to discovered machines
Built-in LAN scanning enables automated network reconnaissance following initial access.
The Linux and ESXi variants implement CIS geofencing by reading LANG, LC_ALL, and /etc/timezone.
It enumerates accessible network shares with WNetOpenEnum and NetShareEnum, walks file systems with standard Win32 APIs
It enumerates accessible network shares with WNetOpenEnum and NetShareEnum
It enumerates accessible network shares with WNetOpenEnum and NetShareEnum, walks file systems with standard Win32 APIs, and probes domain trust relationships.
On top of that, although the Windows variant implements environment detection mechanisms to fly under the radar... The ESXi variant, on the other hand, enforces geofencing and anti-debugging checks prior to commencing the encryption step.
The geofencing step verifies if it's running in a CIS country, and if so, exits without encrypting the files.
Lateral Movement: Propagation occurs via SMB and WinRM pivoting.
Lateral Movement: Propagation occurs via SMB and WinRM pivoting.
Beyond scheduled tasks, the locker uses SMB admin-share copy, WMI execution, DCOM instantiation via MMC20.Application
SSH-based propagation is supported on Linux and ESXi.
Lateral Movement: Propagation occurs via SMB and WinRM pivoting.
The Windows version... features... multiple remote-execution script templates for lateral spread.
Exfiltration is performed either out of band by the affiliate using third-party tools such as Rclone, MEGA, or WinSCP
It enumerates accessible network shares with WNetOpenEnum and NetShareEnum
The group operates a classic double-extortion model... publishing it on a TOR-based leak site... Vect’s entire C2 and negotiation infrastructure operates exclusively over TOR.
Block outbound Tor entry-node connectivity and onion-name resolution at the network perimeter, since Vect command and control runs exclusively over Tor.
Vect provides encryption and extortion tooling
On 15 April 2026, Vect listed its first known victim—a property-management technology company—claiming exfiltration of approximately four million emails and 700 GB of data
On its dark website, the group displays the message 'Exfiltration / Encryption / Extortion,' highlighting its triple-threat business model.
Impact Data Destruction T1485 Implementation defects can irreversibly corrupt files, producing a wiper-like effect regardless of intent.
the Vect ransomware affiliate announcement... no confirmed Vect deployments linked to TeamPCP credentials yet
The locker then terminates a hardcoded list of security agents ... backup engines ... database services
Impact Inhibit System Recovery T1490 Detection focuses on shadow-copy/recovery tampering (vssadmin, wbadmin, bcdedit, wevtutil), the standard precursor to unrecoverable ransomware impact.
if –force-safemode is set the locker writes SafeBoot Minimal and Network registry entries plus a Run key so the host reboots into safe mode
The combination of shadow copy deletion, security agent termination, safe-mode persistence, and broken intermittent encryption produces an outcome operationally indistinguishable from a wiper
The strongest attribution link across all TeamPCP operations is a shared RSA-4096 public key embedded in payloads -- search for this key in forensic artifacts from any suspected TeamPCP exposure.
Vect provides encryption and extortion tooling... LAPSUS$ is selling access via Session encrypted messaging... The extortion timeline is accelerating.
22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
51 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.