VECT Ransomware 2.0 — Russian-Speaking RaaS with ChaCha20 Buffer-Reuse Bug Producing Permanent Data Destruction (Wiper-by-Accident) Across Windows, Linux, and ESXi — Threadlinqs Intelligence
As of 2026-05-30, VECT Ransomware 2.0 — Russian-Speaking RaaS with ChaCha20 Buffer-Reuse Bug Producing Permanent Data Destruction (Wiper-by-Accident) Across Windows, Linux, and ESXi is a critical-severity ransomware threat attributed to VECT + TeamPCP (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 27 indicators of compromise.
Threat ID: TL-2026-0432 · Severity: CRITICAL · CVSS: 9.1 · Status: MONITORING · Category: RANSOMWARE
Attribution: VECT + TeamPCP · Russia · FINANCIAL
VECT 2.0 is a Russian-language Ransomware-as-a-Service operation first advertised on BreachForums in December 2025 with cross-platform Windows, Linux, and VMware ESXi lockers. The malware uses
VECT Ransomware 2.0 (tracked as TL-2026-0432) is the second generation of a Russian-speaking ransomware family that surfaced on BreachForums in December 2025 under an open-affiliate model. The operators advertise a 70/30 affiliate split, in-built negotiation portal hosted at vectordntlcrlmfkcm4alni734tbcrnd5lk44v6sp4lqal6noqrgnbyd.onion, and a qTox contact ID for direct affiliate onboarding — characteristic of low-barrier RaaS programs that flooded the market after the LockBit, BlackCat, and Hunters International collapses of 2024–2025.
The payload ships in three distinct ELF/PE variants — Windows (PE64), Linux (ELF64), and a VMware ESXi build that links against ESXi 7.x/8.x libraries and invokes esxcli/vim-cmd to enumerate and stop running virtual machines before locking VMDK files. All three variants share a static Go runtime, an embedded ChaCha20-IETF (RFC 8439) stream cipher implementation, and an identical chunked-encryption routine — and all three carry the same cryptographic flaw.
The encryption routine generates a 32-byte ChaCha20 key and 12-byte nonce per file. For files at or below 128 KB the routine encrypts the whole file under a single nonce and appends a fixed footer containing the RSA-4096-wrapped key and nonce. For files above 128 KB the routine splits the plaintext into four equal chunks, intends to generate a fresh nonce per chunk, and appends a metadata table of (chunk_offset, nonce, length) tuples. In practice, the implementation reuses a single 12-byte buffer for all four nonce_generate() calls and writes that buffer into the metadata table after each chunk encryption — so by the time the file is closed, all four metadata entries point at the same memory holding the fourth nonce. The first three chunks of every file larger than 128 KB are therefore encrypted under nonces that are never persisted and that the operators themselves cannot reconstruct: those chunks are mathematically unrecoverable.
In the field, this transforms VECT into a destructive wiper for any file that crosses 128 KB — which in enterprise environments means virtually all databases, virtual machine disks, hypervisor datastores, backup archives, mail stores, and document repositories. Ransom payment provides no recovery path for these files; only files at or below 128 KB (configuration files, small documents, scripts) are decryptable.
The Windows variant terminates 167 processes including SQL Server, Exchange, Veeam, Acronis, IBM Tivoli, and Backup Exec services via taskkill /F, deletes Volume Shadow Copies via vssadmin delete shadows /all /quiet and wmic shadowcopy delete, disables the Windows Recovery Environment via bcdedit /set {default} recoveryenabled No and bcdedit /set {default} bootstatuspolicy ignoreallfailures, clears Windows event logs via wevtutil cl, and writes a Run-key persistence entry to HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The Linux variant kills mysqld, postgres, mongod, redis-server, and oracle processes, removes /var/log/* contents, and adds an /etc/cron.d entry for persistence. The ESXi variant calls esxcli vm process list, esxcli vm process kill --type=force --world-id=, and unmounts datastores before sweeping VMDKs.
Files are renamed to <original>.<8-byte-hex>.vect and a !!!READ_ME!!!.txt ransom note is dropped in every directory. The note instructs victims to install qTox, message the operator ID 1A51DCBB33FBF603B385D223F599C6D64545E631F7C870FFEA320D84CE5DAF076C1F94100B5B, or visit the .onion negotiation portal.
The two confirmed victims — both small SaaS providers in North America — were initially compromised in March 2026 through TeamPCP, an initial-access broker that publicly partnered with VECT in early March 2026 and specialized in poisoning developer-tooling and AI-stack packages. TeamPCP previously published trojanized versions of the open-source Aqua Security Trivy scanner, Checkmarx KICS infrastructure-as-code scanner, the BerriAI LiteLLM proxy, and a fraudulent Telnyx SDK distributio
Weaknesses (CWE)
CWE-323, CWE-330, CWE-1204, CWE-829
Target sectors: technology, saas, software-development, managed-service-providers, financial, healthcare
Target regions: North America, Europe, Western Europe
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 27 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
RANSOMWARE, CRITICAL, threat intelligence, cybersecurity, T1195, T1195.002, T1078, T1059, T1059.001, T1059.003, T1059.004, T1053, T1547, T1547.001