Loading malware…
VECT 2.0 is a cross-platform ransomware-as-a-service operation that emerged in late 2025 and targets Windows, Linux, and VMware ESXi systems. Although operated as ransomware, severe cryptographic implementation defects make it function in practice as a destructive wiper for many files. For files larger than approximately 128 KB, VECT 2.0 encrypts multiple chunks but retains decryption material only for the final chunk. The missing material is neither retained locally nor provided to the operators, making most affected data permanently unrecoverable even after ransom payment. The flaw affects the Windows, Linux, and ESXi variants.
The Windows variant targets accessible local, removable, and network storage and includes anti-analysis and security-tool evasion functionality, Safe Mode-based persistence, and templates supporting remote execution for lateral movement. ESXi builds implement geofencing and anti-debugging checks and can attempt propagation over SSH; Linux builds share substantially related code. VECT 2.0 has been associated with VECT operators, an open affiliate program promoted through BreachForums, and a partnership with TeamPCP. TeamPCP-linked software supply-chain compromises were used to expand opportunities for ransomware deployment. VECT 2.0 poses particular risk to organizations because databases, backups, virtual-machine disks, mailboxes, and routine business documents commonly exceed its destructive file-size threshold.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The VECT 2.0 ransomware, attributed to a threat actor group (VECT operators), reflects a notable shift in ransomware behavior where operational flaws unintentionally drive destructive outcomes.
36 distinct techniques documented for this family, organized by ATT&CK tactic.
The Credentials field allows an attacker to add domain credentials into the compiled locker payload, which enables automated lateral movement and mass deployment via GPO... Each method begins by setting up credentials.
...эксплойтов...
Additionally, its affiliate-based distribution via BreachForums and alignment with threat group TeamPCP demonstrates convergence with supply-chain compromise strategies...
...с помощью email-спама и вредоносных вложений...
Invoke-WmiMethod -ComputerName $pc -Credential $cred -Class Win32_Process -Name Create -ArgumentList "%ProgramData%\$name" -EA Stop
Or through scheduled tasks: $action=New-ScheduledTaskAction -Execute "%ProgramData%\$name" ... Register-ScheduledTask ... Start-ScheduledTask ... From scheduled tasks installed via the command line: schtasks /create /s $pc ...
The locker also issues commands to subvert Windows Defender via this Powershell command... functionality appears to be implemented via hardcoded Powershell scripts embedded within the locker.
...обманных загрузок... фальшивых обновлений, перепакованных и заражённых инсталляторов.
Methods include propagating via service installation: sc.exe \\\\$pc create $svc binPath= \"C:\\ProgramData\\$name\" type= own start= auto ... sc.exe \\\\$pc start $svc
Or through scheduled tasks: $action=New-ScheduledTaskAction -Execute "%ProgramData%\$name" ... Register-ScheduledTask ... Start-ScheduledTask ... From scheduled tasks installed via the command line: schtasks /create /s $pc ...
The Credentials field allows an attacker to add domain credentials into the compiled locker payload, which enables automated lateral movement and mass deployment via GPO... Each method begins by setting up credentials.
Persistence is obtained by modifying this common registry run key on a victim’s system: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Value: <locker file path>
Версия для Windows... закрепляется в системе через Safe Mode...
Persistence is obtained by modifying this common registry run key on a victim’s system: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Value: <locker file path>
Or through scheduled tasks: $action=New-ScheduledTaskAction -Execute "%ProgramData%\$name" ... Register-ScheduledTask ... Start-ScheduledTask ... From scheduled tasks installed via the command line: schtasks /create /s $pc ...
The Credentials field allows an attacker to add domain credentials into the compiled locker payload, which enables automated lateral movement and mass deployment via GPO... Each method begins by setting up credentials.
The actor advertised... GPO propagation... The hidden PowerShell GPO/lateral command did launch.
Версия для Windows... закрепляется в системе через Safe Mode...
Persistence is obtained by modifying this common registry run key on a victim’s system: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Value: <locker file path>
Backup copies from the Windows volume shadow copy utility are deleted with this command: vssadmin delete shadows /all /quiet
The Credentials field allows an attacker to add domain credentials into the compiled locker payload, which enables automated lateral movement and mass deployment via GPO... Each method begins by setting up credentials.
...проверяет наличие 44 ИБ-инструментов и отладчиков... ESXi-вариант перед шифрованием запускает геофенсинг и антиотладочные проверки...
The Linux and ESXi variants are based on a similar codebase, while the ESXi version additionally implements geofencing and anti-debugging mechanisms.
The Linux and ESXi variants are based on a similar codebase, while the ESXi version additionally implements geofencing and anti-debugging mechanisms.
Persistence is obtained by modifying this common registry run key on a victim’s system: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Value: <locker file path>
The actor advertised... GPO propagation... The hidden PowerShell GPO/lateral command did launch.
The locker also issues commands to subvert Windows Defender... attempts to turn off real-time protection against scripts and files, while disabling real-time scanning and behavioral monitoring.
Event logs clears Application , Security , System , and Windows PowerShell with wevtutil cl
In addition, it includes capabilities designed to evade analysis and security tools, establish persistence through Windows Safe Mode and facilitate lateral movement within the network.
It then enumerates hosts via AD: $pcs=@([adsisearcher]'objectCategory=computer').FindAll()|%{$_.Properties.dnshostname[0]}|?{$_ -and $_ -ne $env:COMPUTERNAME} | It then enumerates hosts via AD... Next, it copies itself to discovered machines
It then enumerates hosts via AD: $pcs=@([adsisearcher]'objectCategory=computer').FindAll()|%{$_.Properties.dnshostname[0]}|?{$_ -and $_ -ne $env:COMPUTERNAME}
Rather than targeting only specific file types, it walks accessible paths and skips a short exclusion list, meaning a wide range of important files fall within its scope.
The actor advertised... network discovery, lateral movement, and GPO propagation.
...проверяет наличие 44 ИБ-инструментов и отладчиков... ESXi-вариант перед шифрованием запускает геофенсинг и антиотладочные проверки...
The Linux and ESXi variants are based on a similar codebase, while the ESXi version additionally implements geofencing and anti-debugging mechanisms.
The Linux and ESXi variants are based on a similar codebase, while the ESXi version additionally implements geofencing and anti-debugging mechanisms.
Vect advertises automated lateral movement and deployment via GPO on Windows... it attempts to execute the remote copy via various methods, including WMI... CIM... scheduled tasks... DCOM... Invoke-Command.
Может распространяться путём взлома через незащищенную конфигурацию RDP...
From DCOM: $com=[activator]::CreateInstance([type]::GetTypeFromProgID('MMC20.Application',$pc)) $com.Document.ActiveView.ExecuteShellCommand("C:\ProgramData\$name",$null,$null,'7')
The ESXi locker also provides an argument dialog showing its capabilities: ... --spread Enable SSH lateral movement
In addition, it includes capabilities designed to evade analysis and security tools, establish persistence through Windows Safe Mode and facilitate lateral movement within the network.
We have also exfiltrated your sensitive data, consisting mostly of databases, backups and other personal information from your company...
On its dark website, the group displays the message 'Exfiltration / Encryption / Extortion,' highlighting its triple-threat business model.
"There is a possibility any large file containing important data could be accidentally wiped instead of encrypted" by the flawed RaaS offering "VECT 2.0."
The malware attempts to encrypt files larger than 131 KB by dividing them into four separate chunks. However, due to the improper handling of encryption nonces during the encryption process, the information required to recover the first three chunks is permanently lost.
Backup copies from the Windows volume shadow copy utility are deleted with this command: vssadmin delete shadows /all /quiet ... Vect runs commands to disable GhettoVCB and Veeam software.
For all files of only 128KB or higher, "this effectively makes Vect a wiper for virtually any file containing meaningful data, enterprise assets such as VM disks, databases, documents and backups included," according to the report.
We have also exfiltrated your sensitive data, consisting mostly of databases, backups and other personal information from your company and will be published on our website if you do not cooperate with us.
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.