# VECT Ransomware 2.0 — Russian-Speaking RaaS with ChaCha20 Buffer-Reuse Bug Producing Permanent Data Destruction (Wiper-by-Accident) Across Windows, Linux, and ESXi

> VECT 2.0 is a Russian-language Ransomware-as-a-Service operation first advertised on BreachForums in December 2025 with cross-platform Windows, Linux, and VMware ESXi lockers. The malware uses ChaCha20-IETF in raw stream mode (no Poly1305 MAC) and chunks files larger than 128 KB into 4 segments — but a buffer-reuse bug overwrites the per-chunk nonce slot 4 times, so only the final nonce persists to disk. The first three of every four chunks of any file >128 KB therefore cannot be decrypted even by the operators, which makes VECT a destructive wiper with a ransomware facade. Two confirmed victims have been observed via TeamPCP supply-chain partnership compromises of Trivy, Checkmarx KICS, LiteLLM, and Telnyx packages in March 2026.

- **Published:** 2026-04-28T12:00:00Z
- **Last reviewed:** 2026-04-28T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0432
- **ID:** TL-2026-0432
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** RANSOMWARE
- **Status:** MONITORING
- **Actor:** VECT + TeamPCP (Russia)
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

VECT Ransomware 2.0 (tracked as TL-2026-0432) is the second generation of a Russian-speaking ransomware family that surfaced on BreachForums in December 2025 under an open-affiliate model. The operators advertise a 70/30 affiliate split, in-built negotiation portal hosted at vectordntlcrlmfkcm4alni734tbcrnd5lk44v6sp4lqal6noqrgnbyd.onion, and a qTox contact ID for direct affiliate onboarding — characteristic of low-barrier RaaS programs that flooded the market after the LockBit, BlackCat, and Hunters International collapses of 2024–2025.

The payload ships in three distinct ELF/PE variants — Windows (PE64), Linux (ELF64), and a VMware ESXi build that links against ESXi 7.x/8.x libraries and invokes esxcli/vim-cmd to enumerate and stop running virtual machines before locking VMDK files. All three variants share a static Go runtime, an embedded ChaCha20-IETF (RFC 8439) stream cipher implementation, and an identical chunked-encryption routine — and all three carry the same cryptographic flaw.

The encryption routine generates a 32-byte ChaCha20 key and 12-byte nonce per file. For files at or below 128 KB the routine encrypts the whole file under a single nonce and appends a fixed footer containing the RSA-4096-wrapped key and nonce. For files above 128 KB the routine splits the plaintext into four equal chunks, intends to generate a fresh nonce per chunk, and appends a metadata table of (chunk_offset, nonce, length) tuples. In practice, the implementation reuses a single 12-byte buffer for all four nonce_generate() calls and writes that buffer into the metadata table after each chunk encryption — so by the time the file is closed, all four metadata entries point at the same memory holding the fourth nonce. The first three chunks of every file larger than 128 KB are therefore encrypted under nonces that are never persisted and that the operators themselves cannot reconstruct: those chunks are mathematically unrecoverable.

In the field, this transforms VECT into a destructive wiper for any file that crosses 128 KB — which in enterprise environments means virtually all databases, virtual machine disks, hypervisor datastores, backup archives, mail stores, and document repositories. Ransom payment provides no recovery path for these files; only files at or below 128 KB (configuration files, small documents, scripts) are decryptable.

The Windows variant terminates 167 processes including SQL Server, Exchange, Veeam, Acronis, IBM Tivoli, and Backup Exec services via taskkill /F, deletes Volume Shadow Copies via vssadmin delete shadows /all /quiet and wmic shadowcopy delete, disables the Windows Recovery Environment via bcdedit /set {default} recoveryenabled No and bcdedit /set {default} bootstatuspolicy ignoreallfailures, clears Windows event logs via wevtutil cl, and writes a Run-key persistence entry to HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The Linux variant kills mysqld, postgres, mongod, redis-server, and oracle processes, removes /var/log/* contents, and adds an /etc/cron.d entry for persistence. The ESXi variant calls esxcli vm process list, esxcli vm process kill --type=force --world-id=, and unmounts datastores before sweeping VMDKs.

Files are renamed to <original>.<8-byte-hex>.vect and a !!!READ_ME!!!.txt ransom note is dropped in every directory. The note instructs victims to install qTox, message the operator ID 1A51DCBB33FBF603B385D223F599C6D64545E631F7C870FFEA320D84CE5DAF076C1F94100B5B, or visit the .onion negotiation portal.

The two confirmed victims — both small SaaS providers in North America — were initially compromised in March 2026 through TeamPCP, an initial-access broker that publicly partnered with VECT in early March 2026 and specialized in poisoning developer-tooling and AI-stack packages. TeamPCP previously published trojanized versions of the open-source Aqua Security Trivy scanner, Checkmarx KICS infrastructure-as-code scanner, the BerriAI LiteLLM proxy, and a fraudulent Telnyx SDK distribution — each of which planted a Go-compiled loader that fetched the VECT payload over HTTPS from a Cloudflare-fronted staging host.

Check Point Research published the cryptographic analysis on 2026-04-28, including reverse-engineered Go pseudocode of the chunked-encryption routine and proof that nonces 0–2 are unrecoverable. The disclosure has so far not deterred new affiliates: BreachForums listings have continued through the disclosure window.

Defenders should treat any VECT infection as data-destruction-equivalent for files >128 KB regardless of ransom posture, prioritize offline immutable backups for VMDK and database files, and apply Trivy/KICS/LiteLLM/Telnyx supply-chain hashes to package-validation gates.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1195.002 Compromise Software Supply Chain
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.004 Unix Shell
- T1053 Scheduled Task/Job
- T1547 Boot or Logon Autostart Execution
- T1547.001 Registry Run Keys / Startup Folder
- T1053.003 Cron
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1685.005 Clear Windows Event Logs
- T1685.006 Clear Linux or Mac System Logs
- T1070.004 File Deletion
- T1027 Obfuscated Files or Information
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1518 Software Discovery
- T1518.001 Security Software Discovery
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1135 Network Share Discovery
- T1021 Remote Services
- T1021.004 SSH
- T1021.002 SMB/Windows Admin Shares
- T1486 Data Encrypted for Impact
- T1485 Data Destruction
- T1561 Disk Wipe
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1529 System Shutdown/Reboot
- T1657 Financial Theft

## Sources

- [VECT: Ransomware by design, Wiper by accident — Check Point Research](https://research.checkpoint.com/2026/vect-ransomware-by-design-wiper-by-accident/)
- [MITRE ATT&CK T1486 — Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486/)
- [MITRE ATT&CK T1561 — Disk Wipe](https://attack.mitre.org/techniques/T1561/)
- [MITRE ATT&CK T1490 — Inhibit System Recovery](https://attack.mitre.org/techniques/T1490/)
- [MITRE ATT&CK T1195.002 — Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
- [RFC 8439 — ChaCha20 and Poly1305 for IETF Protocols](https://datatracker.ietf.org/doc/html/rfc8439)
- [CWE-323 — Reusing a Nonce, Key Pair in Encryption](https://cwe.mitre.org/data/definitions/323.html)
- [CWE-829 — Inclusion of Functionality from Untrusted Control Sphere (Supply Chain)](https://cwe.mitre.org/data/definitions/829.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0432