VECT 2.0 / DEVMAN 3.0 Ransomware — Design-Flawed ChaCha20 Encryption Irreversibly Destroys Files Over 128KB on Windows, Linux & ESXi (Wiper by Accident) — Threadlinqs Intelligence
As of 2026-06-06, VECT 2.0 / DEVMAN 3.0 Ransomware — Design-Flawed ChaCha20 Encryption Irreversibly Destroys Files Over 128KB on Windows, Linux & ESXi (Wiper by Accident) is a high-severity ransomware threat attributed to VECT RaaS operators, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 16 indicators of compromise.
Threat ID: TL-2026-0697 · Severity: HIGH · Status: ACTIVE · Category: RANSOMWARE
Attribution: VECT RaaS operators · FINANCIAL
VECT 2.0 (related builds branded DEVMAN 3.0) is cross-platform RaaS ransomware (Windows PE64, Linux ELF64, VMware ESXi ELF64) that catastrophically fails to decrypt its own victims. For every file
VECT 2.0 is a cross-platform Ransomware-as-a-Service family first advertised in December 2025 and analyzed publicly in April 2026 by Morphisec and Check Point Research. Builds branded DEVMAN 3.0 share the same codebase. The malware ships as native binaries for Windows (PE64 x86-64), Linux (ELF64 x86-64) and VMware ESXi (ELF64 x86-64), all sharing identical encryption logic and the same fatal design flaw.
Encryption uses raw ChaCha20-IETF (RFC 8439) from a statically-linked libsodium — NOT ChaCha20-Poly1305 AEAD — with a 32-byte key and 12-byte nonce, and no authentication tag, magic value, or version field. For files at or below 128KB the on-disk layout is [ChaCha20 ciphertext][12-byte nonce], which is recoverable. For files above 131,072 bytes the malware computes quarter offsets (0, 1/4, 1/2, 3/4), encrypts up to 32,768 bytes at each offset with four independent random nonces written to a shared buffer, but only the LAST nonce survives to disk. The first three nonces are overwritten and lost, permanently destroying 75% of every large file's encrypted regions. Full recovery is impossible for anyone, including the attacker.
The Windows build compounds the damage with two further bugs. A buffer-size mismatch lets files in the 32KB < size <= 128KB range enter a code path whose 32KB encryption buffer is smaller than the 128KB read buffer, leaving intermediate files incompletely or inconsistently encrypted. A race condition arises because the path buffer used to build the .vect filename and the 32KB content buffer used for reads are shared across encryptor threads; with CPU-count thread multipliers (x8/x6/x4) producing oversized thread pools, concurrent workers overwrite each other's per-file state and corrupt data.
VECT renames files (appending .vect) BEFORE encrypting content, so the .vect extension does NOT guarantee a file was encrypted — files may be renamed-only plaintext, single-pass encrypted, partially-quadrant-modified, or structurally inconsistent. Targeting is exclusion-based, skipping .exe/.dll/.sys and system directories while encrypting documents, PDFs, archives, databases and virtual disks. The ransom note is dropped as !!!READ_ME!!!.txt.
The build quality is poor throughout: advertised --fast/--medium/--secure modes are parsed but ignored; string obfuscation uses self-cancelling double-XOR; three anti-analysis routines are compiled but never invoked; the Windows variant references 44 security/debugging tools and a Safe Mode persistence mechanism. ESXi/Linux variants enforce CIS geofencing that erroneously includes Ukraine, and the overall code quality is consistent with AI-assisted authorship. The RaaS operates via BreachForums with a $250 XMR (Monero) affiliate entry fee (waived for CIS applicants); observed intrusions abused the TeamPCP supply chain. Defensive guidance is unambiguous: there is no payment value — large files are already destroyed — so response must be backup-first restoration, not negotiation.
Weaknesses (CWE)
CWE-323, CWE-330, CWE-362, CWE-787, CWE-665
Target sectors: technology, managed-service-providers, virtualization-infrastructure, general
Target regions: Global, North America, Europe
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 16 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
RANSOMWARE, HIGH, threat intelligence, cybersecurity, T1583, T1588.001, T1195, T1078, T1059.001, T1059.004, T1047, T1112, T1543.003, T1562.009