Activity timeline
VECT appears in 4 tracked threats between and ; the busiest month was 2026-04 with 1 report.
ATT&CK techniques observed
- T1021.002 SMB/Windows Admin Shares — Lateral Movementobserved in 4 of 4 tracked threats
- T1485 Data Destruction — Impactobserved in 4 of 4 tracked threats
- T1489 Service Stop — Impactobserved in 4 of 4 tracked threats
- T1021.004 SSH — Lateral Movementobserved in 3 of 4 tracked threats
- T1027 Obfuscated Files or Information — Stealth (formerly Defense Evasion)observed in 3 of 4 tracked threats
- T1078 Valid Accounts — Initial Accessobserved in 3 of 4 tracked threats
- T1486 Data Encrypted for Impact — Impactobserved in 3 of 4 tracked threats
- T1490 Inhibit System Recovery — Impactobserved in 3 of 4 tracked threats
- T1685 Disable or Modify Tools — Defense Impairmentobserved in 3 of 4 tracked threats
- T1685.005 Clear Windows Event Logs — Defense Impairmentobserved in 3 of 4 tracked threats
- T1047 Windows Management Instrumentation — Executionobserved in 2 of 4 tracked threats
- T1057 Process Discovery — Discoveryobserved in 2 of 4 tracked threats
- T1059.001 PowerShell — Executionobserved in 2 of 4 tracked threats
- T1059.004 Unix Shell — Executionobserved in 2 of 4 tracked threats
- T1082 System Information Discovery — Discoveryobserved in 2 of 4 tracked threats
Tracked threats
- VECT 2.0 Ransomware's Nonce-Reuse Flaw Turns It Into an Accidental Wiper for Files Over 128KBHIGH
- Ransomware Groups Exploit Citrix Bleed 2 (CVE-2025-5777) and Kontron Driver BYOVD for Access and Privilege EscalationCRITICAL
- VECT 2.0 / DEVMAN 3.0 Ransomware — Design-Flawed ChaCha20 Encryption Irreversibly Destroys Files Over 128KB on Windows, Linux & ESXi (Wiper by Accident)HIGH
- VECT Ransomware 2.0 — Russian-Speaking RaaS with ChaCha20 Buffer-Reuse Bug Producing Permanent Data Destruction (Wiper-by-Accident) Across Windows, Linux, and ESXiCRITICAL