Vect is a sophisticated organized crime group operating a Ransomware-as-a-Service (RaaS) platform. First observed in December 2025, the group has rapidly professionalized its operations, targeting the Manufacturing, Education, and Engineering sectors. Vect employs a double-extortion tactic, exfiltrating sensitive data prior to encryption to coerce victims into payment.

The group is distinguished by its use of a custom-built C++ encryptor that leverages the ChaCha20-Poly1305 algorithm. Benchmarks indicate this encryption scheme is approximately 2.5x faster than AES-256-GCM on systems lacking hardware acceleration (e.g., legacy servers, ESXi hosts).

Recent confirmed activity includes a significant breach of the Federal University of Sergipe (Brazil) in January 2026, an attack on an Engineering Services firm in South Africa, and a newly reported incident involving a South Korean University.

Technical Analysis

Malware Architecture

• Language: C++ (Custom build, no code overlap with known families like LockBit or Conti).
• Encryption Scheme: Uses ChaCha20-Poly1305 (Authenticated Encryption with Associated Data).
  • Strategic Advantage: High throughput on non-AES-NI CPUs and effective integrity checking to prevent data corruption during the rapid encryption process.
• Cross-Platform Targeting:
  • Windows: Standard executable (.exe) utilizing multi-threading.
  • Linux/ESXi: ELF binaries designed to target virtual machine disk images (.vmdk, .vmx) directly.

Operational Capabilities

1. Pre-Encryption Preparation:
   • Process Termination: Aggressively terminates processes related to security software (AV/EDR), backup solutions (Veeam, BackupExec, Acronis), and database services (SQL, Oracle) to ensure open file handles.
   • Safe Mode Execution: The ransomware modifies the Boot Configuration Data (BCD) to force a reboot into Safe Mode with Networking. This bypasses many endpoint protection agents that do not load drivers in Safe Mode.
     • Command Observed: bcdedit /set {default} safeboot network
2. Lateral Movement:
   • Relies heavily on “Living off the Land” (LotL) techniques, utilizing legitimate administrative protocols like SMB (Server Message Block) and WinRM (Windows Remote Management) to propagate across the network.
3. Exfiltration:
   • Data is staged and exfiltrated prior to encryption. The group likely uses Rclone or proprietary exfiltration tools renamed to masquerade as system processes.

Incident Highlights & Victimology

• Federal University of Sergipe (Brazil):
  • Date: January 8, 2026
  • Impact: 150GB of PII (Student Personal Information) and financial records exfiltrated.
  • Significance: High-volume PII theft from the education sector.
• Engineering Services Firm (South Africa):
  • Date: January 5, 2026
  • Significance: Confirms expansion into the EMEA region and industrial sectors.
• South Korean University:
  • Date: Early January 2026 (Reported by ASEC)
  • Significance: Indicates a global, non-geographically bound targeting strategy.

MITRE ATT&CK Mapping (TTPs)

Indicators of Compromise (IOCs)

Note: Hash values are representative of current campaigns and may rotate frequently.

Infrastructure

• Leak Site (TOR):bu7zr6fotni3qxxoxlcmpikwtp5mjzy7jkxt7akflnm2kwkbdtgtjuid.onion
  • Title: “VECT RANSOMWARE // DATA ARCHIVE”
• Victim Chat Portal (TOR): bu7zr6fotni3qxxoxlcmpikwtp5mjzy7jkxt7akflnm2kwkbdtgtjuid.onion/chat
• C2 / Hosting IP: 158.94.210.11 (Port 8000 observed).

File Artifacts

• Ransom Note Filename: VECT_RECOVERY_GUIDE.txt or README_VECT.html
• Encrypted File Extension: .vect (appended to the original filename).
• Malware Filenames:
  • svc_host_update.exe
  • enc_esxi.elf (Linux/ESXi payload)

Ransom Note Pattern

The ransom note typically follows this structure:

“YOUR DATA HAS BEEN ENCRYPTED BY VECT. DO NOT MODIFY FILES. DO NOT RESTART. TO RECOVER YOUR DATA, ACCESS OUR CHAT PORTAL: bu7zr6fotni3qxxoxlcmpikwtp5mjzy7jkxt7akflnm2kwkbdtgtjuid.onion/chat USE THIS ID TO LOGIN: [UUID-FORMAT-CHAT-ID]“

Detection & Mitigation Strategies

Detection Opportunities

1. Safe Mode Boot Activity: Alert on any execution of bcdedit with the safeboot flag. This is a high-fidelity indicator of ransomware activity.
2. Process Termination: Monitor for high-volume process termination events (Event ID 4688) targeting sqlservr.exe, veeam.exe, oracle.exe, or beserver.exe.
3. Network Traffic: Detect outbound connections to 158.94.210.11 or abnormal SMB traffic patterns initiating from non-administrative workstations.

Mitigation Recommendations

• Immutable Backups: Ensure backups are stored offline or in an immutable state (WORM) to prevent encryption by the ransomware.
• Patch ESXi: Apply the latest security patches to VMware ESXi hosts and disable the SLP service if not in use.
• Disable Administrative Shares: Restrict the use of administrative shares (C$, ADMIN$) to prevent lateral movement.
• MFA Enforcement: Enforce Multi-Factor Authentication on all remote access points (VPN, RDP) and administrative accounts.