VECT 2.0 Ransomware Corrupts Victim Files Beyond Recovery

Researchers reported that VECT 2.0 ransomware can permanently damage files through flaws in its own encryption and decryption logic, leaving victims unable to restore data even if they receive the attackers’ decryptor. Analysis of the Windows variant found that the malware appends the .vect extension, targets a wide range of business files on 64-bit systems, and stores too little recovery metadata to reliably reconstruct what happened to each file. Implementation defects reportedly include lost encryption material for large files, buffer-size mismatches affecting mid-sized files, and race conditions caused by shared global buffers across worker threads, resulting in files that may be only renamed, partially encrypted, or structururally corrupted.

Separate reporting describes VECT as a double-extortion ransomware-as-a-service operation with support for Windows, Linux, and VMware ESXi, using lateral movement, defense evasion, shadow-copy deletion, and safe-mode reboot techniques before encryption. The group is linked in reporting to TeamPCP and possible overlaps with Devman, with alleged access from earlier supply-chain compromises involving Trivy, Checkmarx KICS, LiteLLM, and Telnyx feeding later intrusions. Because a critical flaw in VECT’s ChaCha20-based intermittent encryption can render large-file data unrecoverable, defenders are being urged to treat VECT incidents as both ransomware and destructive data-loss events rather than assuming payment will enable recovery.