Vect ransomware

credentials come from the `-c/–creds [base64]` CLI flag as mentioned

Enters via exposed RDP/VPN or stolen credentials.

...эксплойтов...

The two groups announced a formal operational partnership in late March 2026 to combine TeamPCP’s credential harvesting and data theft capabilities with Vect’s ransomware deployment infrastructure in a widespread campaign involving supply chain attacks...

The ongoing attacks targeting Trivy, LiteLLM, and other open source security tools ... are entering a new phase, with claims that TeamPCP has partnered with the Vect ransomware group to leverage supply chain compromises for ransomware operations.

Phishing Possible vulnerable external endpoint.

WMI Win32_Process WMI (TCP 135 + dynamic) Invoke-WmiMethod process creation

WinRM CIM ScheduledTask WinRM (TCP 5985 / 5986) Register + Start scheduled task as SYSTEM

Instead, the module remotely registers Scheduled Tasks over CIM sessions... the task and CIM session are removed within 500 milliseconds, cleaning up artifacts on the target machine.

Execution Command and Scripting Interpreter T1059

Prior to the encryption, the ransomware disables Windows Defenders real-time protection via PowerShell.

...обманных загрузок... фальшивых обновлений, перепакованных и заражённых инсталляторов.

By creating its own entry with the value Service the malware essentially tells Windows “I’m an allowed service in Safe Mode”.

WinRM CIM ScheduledTask WinRM (TCP 5985 / 5986) Register + Start scheduled task as SYSTEM

Instead, the module remotely registers Scheduled Tasks over CIM sessions... the task and CIM session are removed within 500 milliseconds, cleaning up artifacts on the target machine.

credentials come from the `-c/–creds [base64]` CLI flag as mentioned

The malware also modifies the registry to register itself in the Safe Mode whitelist, and the CurrentVersion\Run\ key.

Enters via exposed RDP/VPN or stolen credentials.

PSExec - copies itself to each target, creates a randomly named service via sc.exe to execute the payload, then deletes the service to minimize traces

Версия для Windows... закрепляется в системе через Safe Mode...

Then the CurrentVersion\Run\ entry ensures it actually starts up.

WinRM CIM ScheduledTask WinRM (TCP 5985 / 5986) Register + Start scheduled task as SYSTEM

Instead, the module remotely registers Scheduled Tasks over CIM sessions... the task and CIM session are removed within 500 milliseconds, cleaning up artifacts on the target machine.

credentials come from the `-c/–creds [base64]` CLI flag as mentioned

Privilege Escalation Access Token Manipulation (inferred) T1134

A “GPO Credentials” field allows affiliates to input Domain Admin credentials directly into the payload builder, enabling automatic distribution via Group Policy Objects without external scripts. This significantly streamlines mass deployment across Windows domains.

PSExec - copies itself to each target, creates a randomly named service via sc.exe to execute the payload, then deletes the service to minimize traces

Версия для Windows... закрепляется в системе через Safe Mode...

Then the CurrentVersion\Run\ entry ensures it actually starts up.

The sample implements obfuscated strings to hinder analysis. Rather than storing plaintext strings for commands and data, it keeps them as encrypted bytes that are assembled and decoded at runtime using rotating XOR.

Built-in Evasion: A “VM Crypter/Packer” toggle standardizes anti-analysis techniques, protecting binaries from immediate signature detection by security tools.

After execution, the task and CIM session are removed within 500 milliseconds, cleaning up artifacts on the target machine.

Delete PowerShell history PSReadLine\ConsoleHost_history.txt

Following this, the malware also uses vssadmin to delete shadow copies with another XOR encrypted string.

credentials come from the `-c/–creds [base64]` CLI flag as mentioned

Privilege Escalation Access Token Manipulation (inferred) T1134

the malware also uses vssadmin to delete shadow copies

Built-in Evasion: A “VM Crypter/Packer” toggle standardizes anti-analysis techniques, protecting binaries from immediate signature detection by security tools.

Both variants implement a geo-fencing check by inspecting system locale variables (LANG, LC_ALL) and the /etc/timezone configuration file and compare them against a hardcoded list of country codes and time zones associated with CIS and post-Soviet regions. If a match is detected, the malware aborts execution and skips encryption.

Additionally to these checks, the malware probes for the presence of a debugger by checking the value of TracerPid in /proc/self/status , exiting if any tracing process is found... The Windows variant implements three layered analyst-environment detection mechanisms.

The malware also modifies the registry to register itself in the Safe Mode whitelist, and the CurrentVersion\Run\ key.

A “GPO Credentials” field allows affiliates to input Domain Admin credentials directly into the payload builder, enabling automatic distribution via Group Policy Objects without external scripts. This significantly streamlines mass deployment across Windows domains.

The decrypted command is a simple PowerShell command that as mentioned, disables Windows Defender real-time detection

For Windows systems, security teams should monitor for PowerShell-based disabling of Windows Defender, event log clearing activity, and suspicious safe-mode boot configuration changes, all of which are key behavioral indicators of Vect ransomware.

–force-safemode Runs `bcdedit /set {default} safeboot minimal` to reboot the machine into Safe Mode, where most AV/EDR agents are not loaded, allowing encryption to proceed.

Likely achieved through: credential dumping/harvested creds existing admin access from initial compromise

All readable keys from the home and /root directories are extracted /etc/ssh/ssh_config and ~/.ssh/config are read and parsed for any hostnames and corresponding usernames

All readable keys from the home and /root directories are extracted /etc/ssh/ssh_config and ~/.ssh/config are read and parsed for any hostnames and corresponding usernames

When running with elevated privileges, the locker stops services via the Windows Service Control Manager... Afterwards, it proceeds with shutting down other services and processes, like databases, backup tools, Hypervisor related services and security products.

Host discovery combines Windows domain enumeration with a local subnet sweep using network adapter information.

built-in LAN scanning for network reconnaissance via DFS and SMB protocols

this is a simple function which just stops targeted services, kills processes

Discovery System Information Discovery T1082

Identifies: file servers, shares, backups virtualisation storage (VHD/VMDK) critical services to kill

the “MPR” library and “NETAPI32” libraries are used to discover network shares that can also be encrypted, alongside other computers on the network that the malware could spread to.

Host discovery combines Windows domain enumeration with a local subnet sweep using network adapter information.

Built-in Evasion: A “VM Crypter/Packer” toggle standardizes anti-analysis techniques, protecting binaries from immediate signature detection by security tools.

Both variants implement a geo-fencing check by inspecting system locale variables (LANG, LC_ALL) and the /etc/timezone configuration file and compare them against a hardcoded list of country codes and time zones associated with CIS and post-Soviet regions. If a match is detected, the malware aborts execution and skips encryption.

Additionally to these checks, the malware probes for the presence of a debugger by checking the value of TracerPid in /proc/self/status , exiting if any tracing process is found... The Windows variant implements three layered analyst-environment detection mechanisms.

The Windows tab allows the affiliate to exclude file extensions and paths as well as provide GPO credentials for compromise and spread through Active Directory environments.

RDP - copies itself to each domain computer, then stores credentials via cmdkey

Remote schtasks.exe SMB + RPC schtasks /create /run /delete as SYSTEM

Methods include: admin share file copy, Windows Credential Manager storage via cmdkey, WMI execution, DCOM/MMC application instantiation, remote scheduled task creation, remote service installation via sc.exe, and PowerShell remoting.

Remote sc.exe service SMB + RPC sc.exe create + start + delete service

automated lateral movement through both SMB-based propagation and Windows Remote Management (WinRM) exploitation

The Windows tab allows the affiliate to exclude file extensions and paths as well as provide GPO credentials for compromise and spread through Active Directory environments.

Steals sensitive data before encryption: victim records, PII, internal docs

Recon + Targeting Identifies: file servers, shares, backups

Command-and-Control Application Layer Protocol: Web T1071.001

Vect’s operational maturity stands out. Its use of purpose-built tooling, TOR-only infrastructure, Monero payments, TOX-based affiliate communications, and a multi-tier affiliate structure points to experienced operators...

If a connection succeeds, the malware copies itself over via scp and executes itself via ssh.

Command-and-Control Encrypted Channel: TOR T1573

Exfiltration Exfiltration Over C2 Channel T1041

It named victims on its leak site, including Guesty, with roughly 700 GB of data allegedly exfiltrated in a campaign tied to TeamPCP’s LiteLLM/Trivy activity.

A fourth download option for an exfiltration-only binary lacking encryption functionality was listed.

All three VECT 2.0 variants share a critical implementation flaw that causes any file larger than 131,072 bytes (128 KB, smaller even than a simple document) to be permanently and irrecoverably destroyed rather than encrypted for later decryption... VECT 2.0 functions in practice as a data wiper with a ransomware facade.

Sportradar AG breach details confirmed: TeamPCP and Vect Joint Operation... confirmed as a 'systemic compromise' jointly operated by TeamPCP and Vect ransomware.

this is a simple function which just stops targeted services, kills processes

Runs commands like: vssadmin delete shadows /all /quiet wbadmin delete catalog -quiet Purpose: ensure no easy restore path.

After encrypting each drive target, the locker drops !!!READ_ME!!!.txt ... Then, it generates a replacement desktop wallpaper (dvm3_wall.bmp) that carries the VECT 2.0 brand banner

Then, it generates a replacement desktop wallpaper (dvm3_wall.bmp) that carries the VECT 2.0 brand banner... Finally... the ransom note is dropped to /home, /root and /tmp, as well as in various system paths: /etc/motd, /etc/issue, /etc/issue.net, /etc/profile.d/vector_notice.sh

--force-safemode Force safemode boot

TeamPCP partnered with established extortion groups to monetize what they had taken. The Lapsus$ group added Checkmarx to its leak site... TeamPCP itself publicly boasted of plans to chain these compromises into ransomware campaigns.