Vect RaaS Emerges With Cross-Platform Locker and Mature Affiliate Operations

Researchers have identified Vect as a new ransomware-as-a-service operation advertising a purportedly custom-built C++ locker for Windows, Linux, and VMware ESXi. The group began recruiting affiliates on a Russian-language cybercrime forum and promotes features including ChaCha20-Poly1305 encryption, intermittent encryption for faster impact, Safe Mode execution, SMB and WinRM propagation, GPO-based deployment, and built-in packing or crypter functionality. Vect also operates TOR-only infrastructure for affiliate onboarding, victim communications, and leak-site publishing, and appears to follow a double-extortion model.

The group has publicly claimed two victims in Brazil and South Africa, although neither the intrusions nor the full malware capabilities have been independently verified. Researchers said Vect shows unusually strong operational maturity for a newly observed crew, citing Monero payments, TOX communications, and a revenue-sharing model that waives entry fees for CIS-based affiliates while charging non-CIS applicants. Reporting suggests the operators may be experienced ransomware actors or a rebrand, and defenders were urged to harden exposed RDP/VPN and edge appliances such as Fortinet interfaces, segment management networks, watch for Safe Mode abuse and intermittent encryption, and strengthen anti-ransomware controls.