Anatomy of an Attack:

Introduction

First appearing in December 2025 and claiming its first victim in January 2026, VECT 2.0 is a ransomware-as-a-service (RaaS) operation that deploys a multi-platform program targeting Windows, Linux, and VMware ESXi lockers. VECT 2.0 is backed by an affiliate model, a dedicated leak site, and strategic distribution partnerships. While the group markets itself as a professional extortion operation, technical analysis shows a significant gap between its presentation and the reliability of its malware.

An important finding is that VECT 2.0 does not behave like recoverable ransomware for most enterprise files. Check Point Research discovered that the malware’s encryption routine discards three of four cryptographic nonces when targeting files larger than 128 KB. Because the attackers need these nonces to decrypt the data, they permanently destroy large files, leaving even themselves unable to unlock them. In practice, VECT 2.0 functions as a wiper hiding behind a ransomware brand. This completely upends standard incident response: defenders must treat a VECT 2.0 attack strictly as a data-loss event. Halcyon's analysis confirms this, warning that a ransom payment simply cannot recover files destroyed by the broken encryption process.

Despite this fatal decrypting flaw,[1] VECT 2.0 RaaS gained rapid momentum between the initial discovery and March 2026, announcing partnerships with TeamPCP and BreachForums. VECT reportedly extorted victims and leaked data stolen during TeamPCP’s supply-chain breaches, ultimately claiming at least 25 victim organizations.

However, following that initial burst of compromises, active reports of VECT 2.0 intrusions stopped entirely in April 2026. This sudden drop-off suggests two possibilities: the threat actors have temporarily gone dark to patch their broken encryptor, or VECT 2.0 was simply a short-lived front designed to quickly monetize the TeamPCP breaches. Industry data shows this rapid lifecycle is standard for modern cybercrime, where most RaaS groups shut down or rebrand within one to two years.

The Cross-Platform Ransomware Flaw

The VECT 2.0 ransomware targets Windows, Linux, and VMware ESXi systems using three distinct variants. Despite running on different platforms, all three share the same core encryption mechanics, which includes the exact same fatal “wiper” flaw. They also share identical capabilities, including command-line interface (CLI) support, lateral movement features, and encrypted file formats.

Every VECT 2.0 variant contains a catastrophic coding error in its encryption routine. If a file is larger than 128 KB, which is roughly the size of a basic three-page Microsoft Word document, the malware permanently destroys the data. The ransomware handles small and large files differently, using 128 KB as its breaking point. Anything larger triggers a flawed “chunking” process.

When VECT 2.0 encounters a file larger than 128 KB, it attempts to encrypt it in four separate chunks. This is where the ransomware is functionally a wiper:

• Generation: The malware creates four distinct, random 12-byte nonces, meaning one for each chunk.
• Execution: It encrypts all four chunks using their respective nonces.
• The Flaw: When saving the final encrypted file to disk, the malware only appends the fourth and final nonce.
• Data Loss: The malware simply drops the first three nonces from memory. It never writes them to disk, saves them to the registry, or sends them back to the attacker's command and control (C2) server. Because of this, they are gone forever.

Initial Access

VECT gains initial access primarily by using valid, stolen credentials [T1078] harvested from earlier ransomware compromises. In January, VECT was observed requesting compromised credentials for Fortinet accounts. The group’s credential acquisition behavior continued. On April 15th, VECT published victim data attributed to TeamPCP-stolen credentials, confirming active monetization of stolen credentials within weeks of collection.

Valid accounts remain a common enabler for ransomware operations because they reduce the need for exploit activity and allow the adversary to use trusted credentials once inside the network. Defenders should expect the earliest signs of a VECT intrusion to appear only after the threat actors have already established a foothold inside the network.

Discovery

Once inside, the Windows variant maps the network by enumerating logical drives [T1083], removable storage, and network-accessible resources [T1046]. It excludes several operating system directories and boot files, ensuring the system remains sufficiently functional for the victim to see ransom instructions.

On Linux and ESXi, VECT defaults to broad local targeting. The Linux locker targets the system root “/”, while the ESXi variant defaults to “/vmfs/volumes”, making virtual infrastructure a primary impact surface.

Lateral Movement

Attackers can use VECT to spread across a network by leveraging several LOLBAS[2] methods. Instead of relying on custom tools, the malware exploits native administrative features to move laterally.

• For Windows: WMI execution [T1047], DCOM [T1021.003], Service Control [T1569.002], SMB [T1021.002], scheduled tasks [T1053.005], and PowerShell remoting [T1059.001].
• For Linux and ESXi: SSH [T1021.004] and SCP [T1071.002].

Persistence

To ensure the attack runs without interruption, attackers can force Windows hosts into Safe Mode. The malware alters the system's boot configuration [T1547.001] and injects its own executable path directly into the registry. During the execution, Task Manager is also disabled [T1489]. This allows the ransomware to maintain persistence in safe mode.

Defense Evasion

VECT 2.0 includes a multi-layered defense evasion system, but the developers made a comical mistake: the main program never actually calls these security-dodging functions. This was likely a testing oversight. The developer probably deactivated the defenses during coding so they wouldn't lock themselves out of their own test environment, then forgot to flip the switch back to "on" before deployment.

If developers ever fix this oversight and enable the code, the Windows variant will use LOLBAS tooling such as PowerShell to disable Windows Defender [T1562.001], clears Windows event logs [T1070.001] with wevtutil, and deletes Volume Shadow Copies [T1070.004] via vssadmin. To further suppress security telemetry, the malware manipulates Windows Safe Mode boot settings, rebooting the machine to terminate security, backup, and database processes before the main payload executes. Persistence is primarily established via the Windows Run registry key.

The dormant code in the Linux and ESXi variants is just as aggressive. It contains routines for anti-debugging checks, timezone and locale geofencing [T1614.001], service disruption, log wiping, shell history clearing, and VM shutdown. The ESXi variant targets firewall components and shuts down vital infrastructure services, including hypervisors, databases, and security products.

Detect the Behavior: MITRE ATT&CK to ExtraHop Mappings

Rethinking Ransomware Defense

VECT 2.0 represents a dangerous shift in the modern cybercrime landscape, combining highly privileged supply-chain credentials with a catastrophically flawed encryptor. Because the 128 KB chunking error permanently destroys large files, paying a ransom will never restore enterprise databases, virtual machine disks, or critical documents.

This destructive reality forces a complete rethink of traditional defense playbooks. Relying solely on endpoint telemetry leaves organizations incredibly vulnerable, especially since the malware actively deletes shadow copies and wipes event logs to blind local agents. To close this blind spot, defenders must pivot toward network detection and response (NDR). Monitoring east-west traffic directly from the wire provides an unaltered record of the intrusion that threat actors cannot tamper with. To intercept these destructive attacks before they trigger permanent data loss, security teams must secure visibility into lateral movement and administrative protocol abuse.

ExtraHop NDR Detection and Capabilities

Because VECT 2.0 actively wipes host logs and disables local security tools, defenders cannot rely on endpoint data alone. They need an independent, tamper-proof record of the network. ExtraHop NDR provides this visibility by tracking and recording exactly how systems communicate before, during, and after an attack.

The VECT 2.0 attack chain relies on stolen credentials, administrative protocols, and internal east-west movement. Because these actions easily blend in with normal daily operations, defenders need deep visibility into network traffic. ExtraHop RevealX decodes and analyzes these enterprise protocols at scale. When you enable decryption, RevealX exposes the exact commands and payloads moving across the wire, unmasking malicious activity that would otherwise stay hidden.

Instead of relying on a single, easily modified malware signature, RevealX spots the distinct network patterns that VECT 2.0 generates. Defenders can look for indicators such as:

• Irregular Access: Inbound remote desktop traffic from unusual locations or unexpected login times.
• Protocol Abuse: Unusual SMB file transfers or new WMI and DCOM executions.
• Data Anomalies: Sudden shifts in data entropy that signal mass encryption.

Correlating these behaviors helps defenders intercept the ransomware operation before it triggers widespread file destruction.

This shared network visibility is vital for both SOC and NOC teams during an incident. SOC analysts use pre-correlated intelligence—including asset identity, protocol behavior, and baseline comparisons—to quickly map out the attack chain. At the same time, NOC teams use that exact same network context to investigate service disruptions and hypervisor outages. Because ransomware threatens both security and system availability, a single, unified network view ensures both teams know exactly what changed, what was communicated, and which systems are affected.

Technical Takeaways

• Treat VECT 2.0 as a data wiper. An encryption coding flaw permanently discards the nonces required to decrypt any file larger than 128 KB. Paying the ransom will not recover these large files
• Prepare for cross-platform attacks. Operators deploy Windows, Linux, and ESXi variants to compromise workstations, servers, and virtualization environments during a single intrusion.
• Monitor east-west traffic. The ransomware spreads internally by abusing native administrative protocols like SMB, WMI, DCOM, and SSH rather than relying on custom exploits.
• Expect full file destruction. The Linux and ESXi variants accept command-line flags for faster, partial encryption modes. However, the malware silently ignores these settings and executes its full wiping routine every time.
• Prioritize hypervisor telemetry. The ESXi variant executes shell commands that force-stop running virtual machines, instantly escalating the blast radius from individual servers to entire application stacks.

Recommended Response

• Monitor for unexpected bcdedit commands or changes to the SafeBoot registry keys, which VECT uses to force a Safe Mode reboot and bypass endpoint defenses.
• Treat unusual ESXi datastore access or sudden vmware-cmd and esxcli VM shutdown commands as critical alerts.
• Harden administrative credentials and enforce multi-factor authentication, especially for domain, backup, and hypervisor management accounts.
• Isolate ESXi management interfaces from the general corporate network to block unauthorized SSH access.
• Investigate sudden data entropy changes, high-volume file modifications, or the appearance of .vect file extensions.
• Preserve network traffic records early in the investigation. VECT actively runs commands like vssadmin delete shadows and clears Windows Event Logs to destroy host-level evidence.
• Evaluate ExtraHop NDR and NPM products to improve visibility across lateral movement, ransomware-linked behavior, and administrative protocol abuse.

Additional Resources

• BleepingComputer: Broken VECT 2.0 ransomware acts as a data wiper for large files
• Check Point Research: VECT: Ransomware by design, Wiper by accident
• Darkatlas: https://darkatlas.io/blog/in-depth-technical-analysis-of-vect-ransomware
• Dark Reading: Vect 2.0 Ransomware Acts as Wiper, Thanks to Design Error
• IBM: Ransomware Resilience Tops Findings in X-Force Threat Intelligence Index 2022
• LevelBlue: https://www.levelblue.com/blogs/spiderlabs-blog/inside-vect-ransomware-as-a-service
• SC Media: TeamPCP-linked VECT 2.0 ransomware unintentionally destroys files larger than 128 KB
• Techradar: VECT is Being Marketed as Ransomware But Functions as a Data Destruction Tool
• The Hacker News: VECT 2.0 Ransomware Irreversibly Destroys Files Over 131KB on Windows, Linux, ESXi
• Toms Hardware: Ransomware Accidentally Destroys All Files Larger Than 128kb
• Ransomware.live: VECT RaaS Group

[1] It’s a wiper ‘feature’ not a bug.

[2] Living off the Land Binaries and Scripts (LOLBAS)