VECT 2.0 / DEVMAN 3.0 Ransomware — Design-Flawed ChaCha20 Encryption Irreversibly Destroys Files Over 128KB on Windows, Linux & ESXi (Wiper by Accident)
VECT 2.0 / DEVMAN 3.0 Ransomware (TL-2026-0697), also tracked as VECT 2.0, is a high-severity ransomware operation, first published 2026-06-06. It is attributed to VECT RaaS operators with low confidence, affects Microsoft Windows, maps to 20 MITRE ATT&CK techniques (T1021.002, T1021.003, T1021.004), and is covered by 9 detection rules and 16 indicators of compromise.
Key facts for TL-2026-0697
- Threat ID
- TL-2026-0697
- Also known as
- VECT 2.0, DEVMAN 3.0
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-06-06
- Last reviewed
- 2026-06-06
- Attribution
- VECT RaaS operators
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, managed-service-providers, virtualization-infrastructure, general
- Target regions
- Global, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in VECT 2.0 / DEVMAN 3.0 Ransomware
Malware and tooling: vect, 1A51DCBB33FBF603B385D223F599C6D64545E631F7C870FFEA320D84CE5DAF076C1F94100B5B, libsodium (statically linked)
VECT 2.0 (related builds branded DEVMAN 3.0) is cross-platform RaaS ransomware (Windows PE64, Linux ELF64, VMware ESXi ELF64) that catastrophically fails to decrypt its own victims. For every file larger than 131,072 bytes it splits the file into four quadrants, encrypts a 32KB block in each with four fresh 12-byte ChaCha20-IETF nonces, but appends only the final nonce to disk — silently discarding the other three. The first three quadrants are unrecoverable by anyone, including the operator's own decryptor, making VECT an effective wiper even after a ransom is paid. Additional Windows flaws (a 32KB–128KB destination-buffer mismatch and a globally-shared worker-thread buffer race) leave files renamed-only, partially encrypted, or structurally corrupted.
How VECT 2.0 / DEVMAN 3.0 Ransomware works
VECT 2.0 is a cross-platform Ransomware-as-a-Service family first advertised in December 2025 and analyzed publicly in April 2026 by Morphisec and Check Point Research. Builds branded DEVMAN 3.0 share the same codebase. The malware ships as native binaries for Windows (PE64 x86-64), Linux (ELF64 x86-64) and VMware ESXi (ELF64 x86-64), all sharing identical encryption logic and the same fatal design flaw.
Encryption uses raw ChaCha20-IETF (RFC 8439) from a statically-linked libsodium — NOT ChaCha20-Poly1305 AEAD — with a 32-byte key and 12-byte nonce, and no authentication tag, magic value, or version field. For files at or below 128KB the on-disk layout is [ChaCha20 ciphertext][12-byte nonce], which is recoverable. For files above 131,072 bytes the malware computes quarter offsets (0, 1/4, 1/2, 3/4), encrypts up to 32,768 bytes at each offset with four independent random nonces written to a shared buffer, but only the LAST nonce survives to disk. The first three nonces are overwritten and lost, permanently destroying 75% of every large file's encrypted regions. Full recovery is impossible for anyone, including the attacker.
The Windows build compounds the damage with two further bugs. A buffer-size mismatch lets files in the 32KB < size <= 128KB range enter a code path whose 32KB encryption buffer is smaller than the 128KB read buffer, leaving intermediate files incompletely or inconsistently encrypted. A race condition arises because the path buffer used to build the .vect filename and the 32KB content buffer used for reads are shared across encryptor threads; with CPU-count thread multipliers (x8/x6/x4) producing oversized thread pools, concurrent workers overwrite each other's per-file state and corrupt data.
VECT renames files (appending .vect) BEFORE encrypting content, so the .vect extension does NOT guarantee a file was encrypted — files may be renamed-only plaintext, single-pass encrypted, partially-quadrant-modified, or structurally inconsistent. Targeting is exclusion-based, skipping .exe/.dll/.sys and system directories while encrypting documents, PDFs, archives, databases and virtual disks. The ransom note is dropped as !!!READ_ME!!!.txt.
The build quality is poor throughout: advertised --fast/--medium/--secure modes are parsed but ignored; string obfuscation uses self-cancelling double-XOR; three anti-analysis routines are compiled but never invoked; the Windows variant references 44 security/debugging tools and a Safe Mode persistence mechanism. ESXi/Linux variants enforce CIS geofencing that erroneously includes Ukraine, and the overall code quality is consistent with AI-assisted authorship. The RaaS operates via BreachForums with a $250 XMR (Monero) affiliate entry fee (waived for CIS applicants); observed intrusions abused the TeamPCP supply chain. Defensive guidance is unambiguous: there is no payment value — large files are already destroyed — so response must be backup-first restoration, not negotiation.
MITRE ATT&CK techniques used in TL-2026-0697
Lateral Movement
T1021.002 Remote Services: SMB/Windows Admin Shares; T1021.003 Remote Services: Distributed Component Object Model; T1021.004 Remote Services: SSH
Defense Evasion
T1027 Obfuscated Files or Information
Execution
T1047 Windows Management Instrumentation; T1059.001 Command and Scripting Interpreter: PowerShell; T1059.004 Command and Scripting Interpreter: Unix Shell
Discovery
T1057 Process Discovery; T1082 System Information Discovery
Initial Access
T1078 Valid Accounts; T1195 Supply Chain Compromise
Persistence
T1112 Modify Registry; T1543.003 Create or Modify System Process: Windows Service
Impact
T1485 Data Destruction; T1486 Data Encrypted for Impact; T1489 Service Stop
Credential Access
Resource Development
T1583 Acquire Infrastructure; T1588.001 Obtain Capabilities: Malware
defense-impairment
Affected products and versions in VECT 2.0 / DEVMAN 3.0 Ransomware
- Microsoft — Windows
Vulnerable versions: x86-64 hosts (PE64 binary) - Linux — Linux x86-64
Vulnerable versions: ELF64 hosts - VMware — ESXi
Vulnerable versions: x86-64 ESXi hosts (ELF64 encryptor)
Remediation for VECT 2.0 / DEVMAN 3.0 Ransomware
Immediate actions
- Treat any host with .vect files or !!!READ_ME!!!.txt as compromised and isolate it from the network immediately
- Do NOT pay the ransom — files over 128KB are mathematically unrecoverable even by the operator's decryptor
- Preserve forensic copies of encrypted files before any restoration attempt (small files <=128KB may be partially recoverable)
- Block the known SHA-256 sample hashes at EDR/AV and hunt for the .vect extension and !!!READ_ME!!!.txt across endpoints, Linux hosts and ESXi datastores
Workarounds
- Disable SSH on ESXi hosts when not in active use
- Restrict lateral-movement protocols (SMB, WMI, DCOM, PSRemoting) via network segmentation and host firewall
Longer-term hardening
- Maintain and test offline, immutable backups (3-2-1) — they are the only reliable recovery path
- Deploy EDR with behavioral ransomware detection (mass rename, mass file modification, shadow-copy deletion)
- Harden ESXi: enforce lockdown mode, restrict SSH, monitor for unauthorized scp/SSH deployment
- Audit and rotate credentials used for WMI/DCOM/SMB/PowerShell-remoting and SSH to limit lateral movement
Weaknesses (CWE) in VECT 2.0 / DEVMAN 3.0 Ransomware
CWE-323, CWE-330, CWE-362, CWE-787, CWE-665
Timeline of VECT 2.0 / DEVMAN 3.0 Ransomware
- VECT Ransomware-as-a-Service affiliate program first advertised on BreachForums with a $250 XMR entry fee (waived for CIS applicants).
- First confirmed victims observed, compromised via TeamPCP supply-chain attacks.
- Related builds identified under the DEVMAN 3.0 brand sharing the same codebase and encryption logic.
- The Hacker News reports VECT 2.0 irreversibly destroys files over 131KB across Windows, Linux and ESXi.
- Morphisec and Check Point Research independently publish technical analyses revealing the nonce-discarding design flaw that makes VECT an effective wiper.
- Threadlinqs Intelligence publishes full threat profile with detection coverage and attack simulations.
Sources cited for VECT 2.0 / DEVMAN 3.0 Ransomware
Threats related to VECT 2.0 / DEVMAN 3.0 Ransomware
Detection coverage for TL-2026-0697
As of 2026-06-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0697 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.