# VECT 2.0 / DEVMAN 3.0 Ransomware — Design-Flawed ChaCha20 Encryption Irreversibly Destroys Files Over 128KB on Windows, Linux & ESXi (Wiper by Accident)

> VECT 2.0 (related builds branded DEVMAN 3.0) is cross-platform RaaS ransomware (Windows PE64, Linux ELF64, VMware ESXi ELF64) that catastrophically fails to decrypt its own victims. For every file larger than 131,072 bytes it splits the file into four quadrants, encrypts a 32KB block in each with four fresh 12-byte ChaCha20-IETF nonces, but appends only the final nonce to disk — silently discarding the other three. The first three quadrants are unrecoverable by anyone, including the operator's own decryptor, making VECT an effective wiper even after a ransom is paid. Additional Windows flaws (a 32KB–128KB destination-buffer mismatch and a globally-shared worker-thread buffer race) leave files renamed-only, partially encrypted, or structurally corrupted.

- **Published:** 2026-06-06T00:00:00Z
- **Last reviewed:** 2026-06-06T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0697
- **ID:** TL-2026-0697
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** VECT RaaS operators
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

VECT 2.0 is a cross-platform Ransomware-as-a-Service family first advertised in December 2025 and analyzed publicly in April 2026 by Morphisec and Check Point Research. Builds branded DEVMAN 3.0 share the same codebase. The malware ships as native binaries for Windows (PE64 x86-64), Linux (ELF64 x86-64) and VMware ESXi (ELF64 x86-64), all sharing identical encryption logic and the same fatal design flaw.

Encryption uses raw ChaCha20-IETF (RFC 8439) from a statically-linked libsodium — NOT ChaCha20-Poly1305 AEAD — with a 32-byte key and 12-byte nonce, and no authentication tag, magic value, or version field. For files at or below 128KB the on-disk layout is [ChaCha20 ciphertext][12-byte nonce], which is recoverable. For files above 131,072 bytes the malware computes quarter offsets (0, 1/4, 1/2, 3/4), encrypts up to 32,768 bytes at each offset with four independent random nonces written to a shared buffer, but only the LAST nonce survives to disk. The first three nonces are overwritten and lost, permanently destroying 75% of every large file's encrypted regions. Full recovery is impossible for anyone, including the attacker.

The Windows build compounds the damage with two further bugs. A buffer-size mismatch lets files in the 32KB < size <= 128KB range enter a code path whose 32KB encryption buffer is smaller than the 128KB read buffer, leaving intermediate files incompletely or inconsistently encrypted. A race condition arises because the path buffer used to build the .vect filename and the 32KB content buffer used for reads are shared across encryptor threads; with CPU-count thread multipliers (x8/x6/x4) producing oversized thread pools, concurrent workers overwrite each other's per-file state and corrupt data.

VECT renames files (appending .vect) BEFORE encrypting content, so the .vect extension does NOT guarantee a file was encrypted — files may be renamed-only plaintext, single-pass encrypted, partially-quadrant-modified, or structurally inconsistent. Targeting is exclusion-based, skipping .exe/.dll/.sys and system directories while encrypting documents, PDFs, archives, databases and virtual disks. The ransom note is dropped as !!!READ_ME!!!.txt.

The build quality is poor throughout: advertised --fast/--medium/--secure modes are parsed but ignored; string obfuscation uses self-cancelling double-XOR; three anti-analysis routines are compiled but never invoked; the Windows variant references 44 security/debugging tools and a Safe Mode persistence mechanism. ESXi/Linux variants enforce CIS geofencing that erroneously includes Ukraine, and the overall code quality is consistent with AI-assisted authorship. The RaaS operates via BreachForums with a $250 XMR (Monero) affiliate entry fee (waived for CIS applicants); observed intrusions abused the TeamPCP supply chain. Defensive guidance is unambiguous: there is no payment value — large files are already destroyed — so response must be backup-first restoration, not negotiation.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1588.001 Obtain Capabilities: Malware
- T1195 Supply Chain Compromise
- T1078 Valid Accounts
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1047 Windows Management Instrumentation
- T1112 Modify Registry
- T1543.003 Create or Modify System Process: Windows Service
- T1688 Safe Mode Boot
- T1027 Obfuscated Files or Information
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1057 Process Discovery
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1021.004 Remote Services: SSH
- T1021.003 Remote Services: Distributed Component Object Model
- T1486 Data Encrypted for Impact
- T1485 Data Destruction
- T1489 Service Stop

## Sources

- [VECT: Ransomware That Can't Decrypt](https://www.morphisec.com/blog/vect-ransomware-that-cant-decrypt/)
- [VECT: Ransomware by design, Wiper by accident](https://research.checkpoint.com/2026/vect-ransomware-by-design-wiper-by-accident/)
- [VECT 2.0 Ransomware Irreversibly Destroys Files Over 131KB on Windows, Linux, ESXi](https://thehackernews.com/2026/04/vect-20-ransomware-irreversibly.html)
- [RFC 8439 — ChaCha20 and Poly1305 for IETF Protocols](https://www.rfc-editor.org/rfc/rfc8439)
- [CWE-323: Reusing a Nonce, Key Pair in Encryption](https://cwe.mitre.org/data/definitions/323.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0697