Loading malware…
VECT 2.0 is a cross-platform ransomware-as-a-service operation that emerged in late 2025 and targets Windows, Linux, and VMware ESXi systems. Although operated as ransomware, severe cryptographic implementation defects make it function in practice as a destructive wiper for many files. For files larger than approximately 128 KB, VECT 2.0 encrypts multiple chunks but retains decryption material only for the final chunk. The missing material is neither retained locally nor provided to the operators, making most affected data permanently unrecoverable even after ransom payment. The flaw affects the Windows, Linux, and ESXi variants.
The Windows variant targets accessible local, removable, and network storage and includes anti-analysis and security-tool evasion functionality, Safe Mode-based persistence, and templates supporting remote execution for lateral movement. ESXi builds implement geofencing and anti-debugging checks and can attempt propagation over SSH; Linux builds share substantially related code. VECT 2.0 has been associated with VECT operators, an open affiliate program promoted through BreachForums, and a partnership with TeamPCP. TeamPCP-linked software supply-chain compromises were used to expand opportunities for ransomware deployment. VECT 2.0 poses particular risk to organizations because databases, backups, virtual-machine disks, mailboxes, and routine business documents commonly exceed its destructive file-size threshold.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The VECT 2.0 ransomware, attributed to a threat actor group (VECT operators), reflects a notable shift in ransomware behavior where operational flaws unintentionally drive destructive outcomes.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Invoke-WmiMethod -ComputerName $pc -Credential $cred -Class Win32_Process -Name Create -ArgumentList "%ProgramData%\$name" -EA Stop
Or through scheduled tasks: $action=New-ScheduledTaskAction -Execute "%ProgramData%\$name" ... Register-ScheduledTask ... Start-ScheduledTask ... From scheduled tasks installed via the command line: schtasks /create /s $pc ...
Or through scheduled tasks: $action=New-ScheduledTaskAction -Execute "%ProgramData%\$name" ... Register-ScheduledTask ... Start-ScheduledTask ... From scheduled tasks installed via the command line: schtasks /create /s $pc ...
The Credentials field allows an attacker to add domain credentials into the compiled locker payload, which enables automated lateral movement and mass deployment via GPO... Each method begins by setting up credentials.
Or through scheduled tasks: $action=New-ScheduledTaskAction -Execute "%ProgramData%\$name" ... Register-ScheduledTask ... Start-ScheduledTask ... From scheduled tasks installed via the command line: schtasks /create /s $pc ...
The Credentials field allows an attacker to add domain credentials into the compiled locker payload, which enables automated lateral movement and mass deployment via GPO... Each method begins by setting up credentials.
Event logs clears Application , Security , System , and Windows PowerShell with wevtutil cl
Backup copies from the Windows volume shadow copy utility are deleted with this command: vssadmin delete shadows /all /quiet
The Credentials field allows an attacker to add domain credentials into the compiled locker payload, which enables automated lateral movement and mass deployment via GPO... Each method begins by setting up credentials.
It then enumerates hosts via AD: $pcs=@([adsisearcher]'objectCategory=computer').FindAll()|%{$_.Properties.dnshostname[0]}|?{$_ -and $_ -ne $env:COMPUTERNAME} | It then enumerates hosts via AD... Next, it copies itself to discovered machines
It then enumerates hosts via AD: $pcs=@([adsisearcher]'objectCategory=computer').FindAll()|%{$_.Properties.dnshostname[0]}|?{$_ -and $_ -ne $env:COMPUTERNAME}
Rather than targeting only specific file types, it walks accessible paths and skips a short exclusion list, meaning a wide range of important files fall within its scope.
The actor advertised... network discovery, lateral movement, and GPO propagation.
Vect advertises automated lateral movement and deployment via GPO on Windows... it attempts to execute the remote copy via various methods, including WMI... CIM... scheduled tasks... DCOM... Invoke-Command.
From DCOM: $com=[activator]::CreateInstance([type]::GetTypeFromProgID('MMC20.Application',$pc)) $com.Document.ActiveView.ExecuteShellCommand("C:\ProgramData\$name",$null,$null,'7')
"There is a possibility any large file containing important data could be accidentally wiped instead of encrypted" by the flawed RaaS offering "VECT 2.0."
The malware attempts to encrypt files larger than 131 KB by dividing them into four separate chunks. However, due to the improper handling of encryption nonces during the encryption process, the information required to recover the first three chunks is permanently lost.
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A flawed ransomware-as-a-service offering that may accidentally wipe large files containing important data rather than encrypting them.
A ransomware-as-a-service malware targeting Windows, Linux, and ESXi systems. Due to improper handling of encryption nonces, it irreversibly destroys much of large files instead of enabling recoverable encryption, making it function more like a destructive data wiper than conventional ransomware.
64-bit Windows ransomware that encrypts business data and appends the .vect extension. The report states its design is flawed: it renames files before encryption, stores minimal metadata, may only partially encrypt files, and uses multi-threaded shared buffers that can corrupt or inconsistently process files, preventing reliable recovery even with the attacker’s decryptor.
A ransomware family promoted as part of a nascent RaaS operation; researchers described it as amateur and said it destroys most data instead of properly encrypting it.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.