VECT Ransomware 2.0 — Russian-Speaking RaaS with ChaCha20 Buffer-Reuse Bug Producing Permanent Data Destruction (Wiper-by-Accident) Across Windows, Linux, and ESXi
VECT Ransomware 2.0 (TL-2026-0432), also tracked as VECT 2.0, is a critical-severity ransomware operation scored CVSS 9.1, first published 2026-04-28. It is attributed to VECT + TeamPCP (Russia) with medium confidence, affects Aqua Security Trivy, maps to 34 MITRE ATT&CK techniques (T1003, T1021, T1021.002), and is covered by 9 detection rules and 27 indicators of compromise.
Key facts for TL-2026-0432
- Threat ID
- TL-2026-0432
- Also known as
- VECT 2.0, VECT Ransomware, VECTOR Ransomware
- Severity
- CRITICAL
- CVSS
- 9.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- RANSOMWARE
- First published
- 2026-04-28
- Last reviewed
- 2026-04-28
- Attribution
- VECT + TeamPCP
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- technology, saas, software-development, managed-service-providers, financial, healthcare
- Target regions
- North America, Europe, Western Europe
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in VECT Ransomware 2.0
Malware and tooling: vect, Cloudflare-fronted HTTPS staging
VECT 2.0 is a Russian-language Ransomware-as-a-Service operation first advertised on BreachForums in December 2025 with cross-platform Windows, Linux, and VMware ESXi lockers. The malware uses ChaCha20-IETF in raw stream mode (no Poly1305 MAC) and chunks files larger than 128 KB into 4 segments — but a buffer-reuse bug overwrites the per-chunk nonce slot 4 times, so only the final nonce persists to disk. The first three of every four chunks of any file >128 KB therefore cannot be decrypted even by the operators, which makes VECT a destructive wiper with a ransomware facade. Two confirmed victims have been observed via TeamPCP supply-chain partnership compromises of Trivy, Checkmarx KICS, LiteLLM, and Telnyx packages in March 2026.
How VECT Ransomware 2.0 works
VECT Ransomware 2.0 (tracked as TL-2026-0432) is the second generation of a Russian-speaking ransomware family that surfaced on BreachForums in December 2025 under an open-affiliate model. The operators advertise a 70/30 affiliate split, in-built negotiation portal hosted at vectordntlcrlmfkcm4alni734tbcrnd5lk44v6sp4lqal6noqrgnbyd.onion, and a qTox contact ID for direct affiliate onboarding — characteristic of low-barrier RaaS programs that flooded the market after the LockBit, BlackCat, and Hunters International collapses of 2024–2025.
The payload ships in three distinct ELF/PE variants — Windows (PE64), Linux (ELF64), and a VMware ESXi build that links against ESXi 7.x/8.x libraries and invokes esxcli/vim-cmd to enumerate and stop running virtual machines before locking VMDK files. All three variants share a static Go runtime, an embedded ChaCha20-IETF (RFC 8439) stream cipher implementation, and an identical chunked-encryption routine — and all three carry the same cryptographic flaw.
The encryption routine generates a 32-byte ChaCha20 key and 12-byte nonce per file. For files at or below 128 KB the routine encrypts the whole file under a single nonce and appends a fixed footer containing the RSA-4096-wrapped key and nonce. For files above 128 KB the routine splits the plaintext into four equal chunks, intends to generate a fresh nonce per chunk, and appends a metadata table of (chunk_offset, nonce, length) tuples. In practice, the implementation reuses a single 12-byte buffer for all four nonce_generate() calls and writes that buffer into the metadata table after each chunk encryption — so by the time the file is closed, all four metadata entries point at the same memory holding the fourth nonce. The first three chunks of every file larger than 128 KB are therefore encrypted under nonces that are never persisted and that the operators themselves cannot reconstruct: those chunks are mathematically unrecoverable.
In the field, this transforms VECT into a destructive wiper for any file that crosses 128 KB — which in enterprise environments means virtually all databases, virtual machine disks, hypervisor datastores, backup archives, mail stores, and document repositories. Ransom payment provides no recovery path for these files; only files at or below 128 KB (configuration files, small documents, scripts) are decryptable.
The Windows variant terminates 167 processes including SQL Server, Exchange, Veeam, Acronis, IBM Tivoli, and Backup Exec services via taskkill /F, deletes Volume Shadow Copies via vssadmin delete shadows /all /quiet and wmic shadowcopy delete, disables the Windows Recovery Environment via bcdedit /set {default} recoveryenabled No and bcdedit /set {default} bootstatuspolicy ignoreallfailures, clears Windows event logs via wevtutil cl, and writes a Run-key persistence entry to HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The Linux variant kills mysqld, postgres, mongod, redis-server, and oracle processes, removes /var/log/* contents, and adds an /etc/cron.d entry for persistence. The ESXi variant calls esxcli vm process list, esxcli vm process kill --type=force --world-id=, and unmounts datastores before sweeping VMDKs.
Files are renamed to <original>.<8-byte-hex>.vect and a !!!READ_ME!!!.txt ransom note is dropped in every directory. The note instructs victims to install qTox, message the operator ID 1A51DCBB33FBF603B385D223F599C6D64545E631F7C870FFEA320D84CE5DAF076C1F94100B5B, or visit the .onion negotiation portal.
The two confirmed victims — both small SaaS providers in North America — were initially compromised in March 2026 through TeamPCP, an initial-access broker that publicly partnered with VECT in early March 2026 and specialized in poisoning developer-tooling and AI-stack packages. TeamPCP previously published trojanized versions of the open-source Aqua Security Trivy scanner, Checkmarx KICS infrastructure-as-code scanner, the BerriAI LiteLLM proxy, and a fraudulent Telnyx SDK distribution — each of which planted a Go-compiled loader that fetched the VECT payload over HTTPS from a Cloudflare-fronted staging host.
Check Point Research published the cryptographic analysis on 2026-04-28, including reverse-engineered Go pseudocode of the chunked-encryption routine and proof that nonces 0–2 are unrecoverable. The disclosure has so far not deterred new affiliates: BreachForums listings have continued through the disclosure window.
Defenders should treat any VECT infection as data-destruction-equivalent for files >128 KB regardless of ransom posture, prioritize offline immutable backups for VMDK and database files, and apply Trivy/KICS/LiteLLM/Telnyx supply-chain hashes to package-validation gates.
MITRE ATT&CK techniques used in TL-2026-0432
Credential Access
Lateral Movement
T1021 Remote Services; T1021.002 SMB/Windows Admin Shares; T1021.004 SSH
Defense Evasion
T1027 Obfuscated Files or Information; T1070 Indicator Removal; T1070.004 File Deletion
Execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.004 Unix Shell
Persistence
T1053.003 Cron; T1547 Boot or Logon Autostart Execution; T1547.001 Registry Run Keys / Startup Folder
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1135 Network Share Discovery; T1518 Software Discovery; T1518.001 Security Software Discovery
Initial Access
T1078 Valid Accounts; T1195 Supply Chain Compromise; T1195.002 Compromise Software Supply Chain
Impact
T1485 Data Destruction; T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery; T1529 System Shutdown/Reboot; T1561 Disk Wipe; T1657 Financial Theft
defense-impairment
T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs; T1685.006 Clear Linux or Mac System Logs
Affected products and versions in VECT Ransomware 2.0
- Aqua Security — Trivy
Vulnerable versions: trojanized mirror builds distributed Mar 2026
Fixed in: official signed releases v0.58.x+ - Checkmarx — KICS
Vulnerable versions: trojanized mirror builds distributed Mar 2026
Fixed in: official signed releases from checkmarx.com or GitHub - BerriAI — LiteLLM
Vulnerable versions: trojanized PyPI mirror packages distributed Mar 2026
Fixed in: official PyPI packages with signed manifests - Telnyx — Telnyx SDK
Vulnerable versions: fraudulent SDK distribution observed Mar 2026
Fixed in: official packages from telnyx.com - Microsoft — Windows
Vulnerable versions: Windows 10; Windows 11; Windows Server 2016+ - Linux — Linux Kernel (generic)
Vulnerable versions: any glibc-based x86_64 distribution - VMware (Broadcom) — ESXi
Vulnerable versions: ESXi 7.0; ESXi 8.0
Remediation for VECT Ransomware 2.0
Patches
- Aqua Security: install Trivy from official GitHub releases only — pin to v0.58.x or later signed releases
- Checkmarx: pull KICS only from checkmarx.com or signed GitHub releases — verify SHA-256 against vendor manifest
- BerriAI: install LiteLLM from PyPI with pip --require-hashes against pinned hash list; reject unverified mirrors
- Telnyx: install Telnyx SDK only from telnyx.com or official npm/PyPI packages signed by the vendor
Immediate actions
- Block the VECT Tor negotiation portal vectordntlcrlmfkcm4alni734tbcrnd5lk44v6sp4lqal6noqrgnbyd.onion at egress proxies
- Quarantine and re-image any host that has executed the published Trivy, KICS, LiteLLM, or Telnyx package hashes
- Validate package integrity for Trivy, Checkmarx KICS, LiteLLM, and Telnyx against vendor-signed releases — do not trust mirrors
- Block all known SHA-256 hashes (Windows, Linux, ESXi variants) at EDR and AV layers
- Disable inbound qTox and unsolicited Tor traffic at perimeter and split-tunnel egress
- Verify that ESXi management interfaces are not internet-exposed; isolate ESXi management networks
- Treat any file >128 KB encrypted with .vect extension as permanently lost — do not pay ransom expecting recovery
Workarounds
- Where patching dependencies is infeasible, isolate development build hosts from production networks
- Restrict outbound HTTPS from build agents to a vetted egress allowlist that excludes Cloudflare workers and unfamiliar fronting
- Disable interactive logon on ESXi hosts and require certificate-based vSphere authentication
- Deploy canary files >128 KB with .docx and .vmdk extensions across file shares and alert on rename to .vect
Longer-term hardening
- Maintain offline, immutable, air-gapped backups for databases, VMDKs, and document stores tested at least quarterly
- Deploy EDR with behavioral detection for vssadmin/wmic shadow-copy deletion, bcdedit recovery disabling, and ChaCha20 stream-cipher signatures in unsigned binaries
- Implement application allow-listing on developer workstations to block unsigned Go-compiled loaders
- Adopt SLSA Level 3+ build provenance for all internal dependencies; require Sigstore/cosign signatures for external dependencies
- Segment ESXi management networks from corporate LAN; require jumphosts and MFA for vSphere/ESXi access
- Subscribe package-validation gates (Snyk, Socket, JFrog Xray) to flag Trivy/KICS/LiteLLM/Telnyx package hashes
- Enable Windows Defender Tamper Protection, Controlled Folder Access, and Network Protection enterprise-wide
Weaknesses (CWE) in VECT Ransomware 2.0
CWE-323, CWE-330, CWE-1204, CWE-829
Timeline of VECT Ransomware 2.0
- VECT 2.0 RaaS first advertised on BreachForums in Russian-language section, with open-affiliate model and 70/30 split
- Affiliate onboarding portal opened at .onion address; qTox ID published for direct operator contact
- First Windows (PE64) and Linux (ELF64) VECT 2.0 samples submitted to public sandboxes from EU-based researchers
- ESXi locker variant first observed in the wild — calls esxcli vm process kill and unmounts datastores before encrypting VMDKs
- TeamPCP initial-access broker publicly announces partnership with VECT on BreachForums; begins distributing trojanized Trivy and KICS packages
- Trojanized LiteLLM PyPI mirror and fraudulent Telnyx SDK distributions identified by package-validation services
- First confirmed VECT 2.0 victim — North American SaaS provider compromised via trojanized Trivy in CI pipeline; >40 TB of VMDK data wiped due to crypto bug
- Second confirmed victim — managed-service-provider compromised via trojanized LiteLLM dependency; ESXi cluster locked, all VMDKs unrecoverable
- Check Point Research publishes reverse-engineering analysis revealing the buffer-reuse cryptographic bug; confirms first 3 of 4 chunks of any file >128 KB are mathematically unrecoverable
- As of 2026-05-29, VECT 2.0 RaaS, its destructive ChaCha20-bug wiper payload, and the TeamPCP supply-chain access (Trivy/KICS/LiteLLM/Telnyx) remain operational and undisrupted — no takedown, arrest, or sinkhole. The leak site has gone quiet (~45 days, no new victims since the April 15 S&P Global post) and affiliate access was opened wide April 18, so the actor and tooling persist and could resurge.
Sources cited for VECT Ransomware 2.0
- VECT: Ransomware by design, Wiper by accident — Check Point Research
- MITRE ATT&CK T1486 — Data Encrypted for Impact
- MITRE ATT&CK T1561 — Disk Wipe
- MITRE ATT&CK T1490 — Inhibit System Recovery
- MITRE ATT&CK T1195.002 — Compromise Software Supply Chain
- RFC 8439 — ChaCha20 and Poly1305 for IETF Protocols
- CWE-323 — Reusing a Nonce, Key Pair in Encryption
- CWE-829 — Inclusion of Functionality from Untrusted Control Sphere (Supply Chain)
Threats related to VECT Ransomware 2.0
- VECT 2.0 Ransomware's Nonce-Reuse Flaw Turns It Into an Accidental Wiper for Files Over 128KB
- VECT 2.0 / DEVMAN 3.0 Ransomware — Design-Flawed ChaCha20 Encryption Irreversibly Destroys Files Over 128KB on Windows, Linux & ESXi (Wiper by Accident)
- Kyber Ransomware: Post-Quantum Hybrid Encryption Operation Targeting Windows & VMware ESXi
- Green Blood v2.0 — Golang-Based Double-Extortion Ransomware Targeting South Asia & Africa
- Payload Ransomware — Babuk-Derivative ChaCha20 + Curve25519 ECDH Per-File Encryption Targeting Windows and ESXi
- Conduent Safepay Ransomware Breach — 25M+ PII/PHI Records Exfiltrated from Gov/Healthcare BPO Provider, Double-Extortion Data Theft via VPN Credential Abuse
Detection coverage for TL-2026-0432
As of 2026-04-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0432 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.