Vect ransomware

credentials come from the `-c/–creds [base64]` CLI flag as mentioned

Enters via exposed RDP/VPN or stolen credentials.

The two groups announced a formal operational partnership in late March 2026 to combine TeamPCP’s credential harvesting and data theft capabilities with Vect’s ransomware deployment infrastructure in a widespread campaign involving supply chain attacks...

Phishing Possible vulnerable external endpoint.

WMI Win32_Process WMI (TCP 135 + dynamic) Invoke-WmiMethod process creation

WinRM CIM ScheduledTask WinRM (TCP 5985 / 5986) Register + Start scheduled task as SYSTEM

Execution Command and Scripting Interpreter T1059

Prior to the encryption, the ransomware disables Windows Defenders real-time protection via PowerShell.

By creating its own entry with the value Service the malware essentially tells Windows “I’m an allowed service in Safe Mode”.

WinRM CIM ScheduledTask WinRM (TCP 5985 / 5986) Register + Start scheduled task as SYSTEM

credentials come from the `-c/–creds [base64]` CLI flag as mentioned

The malware also modifies the registry to register itself in the Safe Mode whitelist, and the CurrentVersion\Run\ key.

Enters via exposed RDP/VPN or stolen credentials.

Then the CurrentVersion\Run\ entry ensures it actually starts up.

WinRM CIM ScheduledTask WinRM (TCP 5985 / 5986) Register + Start scheduled task as SYSTEM

credentials come from the `-c/–creds [base64]` CLI flag as mentioned

Privilege Escalation Access Token Manipulation (inferred) T1134

Then the CurrentVersion\Run\ entry ensures it actually starts up.

Following this, the malware also uses vssadmin to delete shadow copies with another XOR encrypted string.

credentials come from the `-c/–creds [base64]` CLI flag as mentioned

Privilege Escalation Access Token Manipulation (inferred) T1134

the malware also uses vssadmin to delete shadow copies

The malware also modifies the registry to register itself in the Safe Mode whitelist, and the CurrentVersion\Run\ key.

Likely achieved through: credential dumping/harvested creds existing admin access from initial compromise

built-in LAN scanning for network reconnaissance via DFS and SMB protocols

this is a simple function which just stops targeted services, kills processes

Discovery System Information Discovery T1082

Identifies: file servers, shares, backups virtualisation storage (VHD/VMDK) critical services to kill

the “MPR” library and “NETAPI32” libraries are used to discover network shares that can also be encrypted, alongside other computers on the network that the malware could spread to.

The Windows tab allows the affiliate to exclude file extensions and paths as well as provide GPO credentials for compromise and spread through Active Directory environments.

Remote schtasks.exe SMB + RPC schtasks /create /run /delete as SYSTEM

Remote sc.exe service SMB + RPC sc.exe create + start + delete service

automated lateral movement through both SMB-based propagation and Windows Remote Management (WinRM) exploitation

The Windows tab allows the affiliate to exclude file extensions and paths as well as provide GPO credentials for compromise and spread through Active Directory environments.

Steals sensitive data before encryption: victim records, PII, internal docs

Recon + Targeting Identifies: file servers, shares, backups

Command-and-Control Application Layer Protocol: Web T1071.001

Command-and-Control Encrypted Channel: TOR T1573

Exfiltration Exfiltration Over C2 Channel T1041

A fourth download option for an exfiltration-only binary lacking encryption functionality was listed.

Sportradar AG breach details confirmed: TeamPCP and Vect Joint Operation... confirmed as a 'systemic compromise' jointly operated by TeamPCP and Vect ransomware.

this is a simple function which just stops targeted services, kills processes

Runs commands like: vssadmin delete shadows /all /quiet wbadmin delete catalog -quiet Purpose: ensure no easy restore path.

TeamPCP partnered with established extortion groups to monetize what they had taken. The Lapsus$ group added Checkmarx to its leak site... TeamPCP itself publicly boasted of plans to chain these compromises into ransomware campaigns.

–force-safemode Runs `bcdedit /set {default} safeboot minimal` to reboot the machine into Safe Mode, where most AV/EDR agents are not loaded, allowing encryption to proceed.

The decrypted command is a simple PowerShell command that as mentioned, disables Windows Defender real-time detection

Defence Evasion Impair Defences: Disable Tools T1562.001