VECT 2.0 Ransomware's Nonce-Reuse Flaw Turns It Into an Accidental Wiper for Files Over 128KB — Threadlinqs Intelligence
As of 2026-08-22, VECT 2.0 Ransomware's Nonce-Reuse Flaw Turns It Into an Accidental Wiper for Files Over 128KB is a high-severity ransomware threat attributed to VECT, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 23 indicators of compromise.
Threat ID: TL-2026-2116 · Severity: HIGH · Status: ACTIVE · Category: RANSOMWARE
Attribution: VECT · FINANCIAL
VECT 2.0, a cross-platform (Windows/Linux/ESXi) Ransomware-as-a-Service family run as an open BreachForums affiliate program, contains a ChaCha20-IETF implementation bug: for files over 131,072 bytes
VECT is a Ransomware-as-a-Service (RaaS) operation that first appeared on a Russian-language cybercrime forum on 2025-12-31. In February 2026 it released VECT 2.0, adding native Linux and VMware ESXi builds alongside the original Windows PE64 build; all three platforms share a single ChaCha20-IETF (RFC 8439) encryption engine built on libsodium, despite the operators' marketing claiming authenticated ChaCha20-Poly1305 AEAD.
Check Point Research's technical teardown (published 2026-04-28) found that any file larger than 131,072 bytes (128KB) is split into four equal quarter-size chunks (max 32,768 bytes each). The malware generates a fresh random 12-byte nonce for each chunk, but all four chunk encryptions write their nonce into the same shared in-memory buffer; only the last-generated nonce is ever appended to the encrypted output file. The first three nonces are irretrievably overwritten before being persisted, so three of every four chunks (~75% of a large file's bytes) can never be decrypted again — not by the victim, and not by the VECT operator, even after a ransom payment. Files at or under 128KB are unaffected and fully recoverable. This makes VECT 2.0 a de facto data wiper for the enterprise assets it is actually deployed against: VM disks, database files, backup archives, and any document or mailbox over the threshold.
Beyond the crypto bug, Check Point documented a pattern of unusually low engineering maturity for a ransomware family running an open affiliate program: the advertised `--fast`/`--medium`/`--secure` encryption-mode flags are parsed but never executed; a double-XOR string-obfuscation routine cancels itself out and leaves plaintext command-line arguments and strings in the compiled binaries; 44 anti-analysis/anti-debugger checks (targeting tools such as OllyDbg, x64dbg, WinDbg, IDA, Process Monitor, and Wireshark) are compiled in but never actually invoked; and the malware spawns 6-7x the host's CPU core count in encryption threads, which degrades rather than improves throughput. Check Point assessed the operators as comparatively novice, noting outdated Commonwealth of Independent States (CIS) geofencing logic — which oddly still excludes Ukraine — as a possible sign of AI-assisted code generation or reused legacy code.
On Windows, VECT 2.0 terminates database and productivity processes (sql.exe, oracle.exe, mysqld.exe, excel.exe, winword.exe, outlook.exe, firefox.exe, thunderbird.exe) to release file locks, disrupts services via WMI/DCOM/SMB/scheduled tasks/PowerShell remoting, moves laterally via Group Policy and network share mounting, deletes Volume Shadow Copies, clears Windows event logs, disables Windows Defender, and can force a reboot into Safe Mode (bypassing security tooling that does not load there) before encrypting. On Linux and ESXi, it enumerates and kills 80+ database, backup, hypervisor-management, and security-product services; harvests SSH private keys and known_hosts entries to spray credentials and move laterally over SSH; issues vmware-cmd/VBoxManage/virsh/esxcli/xm/xl commands to disrupt running virtual machines; and destroys 30+ categories of log files and their rotated variants. Both Linux and ESXi builds check host locale/timezone against a CIS-country blacklist (including, unusually, Ukraine) and exit without encrypting if a match is found.
VECT's operators formalized a partnership with the BreachForums marketplace (300,000+ registered users) in March 2026, and between 2026-04-16 and 2026-04-18 a BreachForums administrator using the handle "diencracked" auto-distributed personal VECT affiliate keys to every registered forum member — no proof of skill, prior track record, or capital required. Separately, VECT partnered with the TeamPCP threat group, which between 2026-03-19 and 2026-03-27 compromised the software supply chains of Trivy, Checkmarx KICS, LiteLLM, and the Telnyx Python SDK (stealing CI/CD secrets, cloud tokens, SSH keys, and Kubernetes credentials from each, a
Target sectors: technology, software development, cloud infrastructure, managed service providers, enterprise it
Target regions: Global (geofencing excludes CIS countries, including Ukraine)
Timeline
- VECT ransomware-as-a-service debuts on a Russian-language cybercrime forum.
- VECT 2.0 is released, adding Linux and VMware ESXi builds alongside the existing Windows variant, sharing the same flawed ChaCha20-IETF chunked-encryption engine across all three platforms.
- TeamPCP and VECT announce a formal partnership on BreachForums: TeamPCP supplies compromised supply-chain victims for VECT to deploy ransomware against and extort.
- TeamPCP compromises Aqua Security's Trivy vulnerability scanner (binary, GitHub Actions workflow, and container images) via an incompletely rotated aqua-bot service-account credential.
- TeamPCP uses credentials stolen from the Trivy compromise to push malicious updates to Checkmarx KICS.
- TeamPCP publishes malicious LiteLLM versions 1.82.7 and 1.82.8 directly to PyPI using stolen CI/CD credentials.
- TeamPCP publishes a malicious release of the Telnyx SDK to PyPI, the fourth package compromised in the campaign.
- A BreachForums administrator using the handle "diencracked" begins auto-distributing personal VECT affiliate keys to every registered forum member, opening the RaaS to 300,000+ potential affiliates with no vetting.
- Check Point Research publishes "VECT: Ransomware by design, Wiper by accident," documenting the nonce-buffer-overwrite flaw that makes files over 131,072 bytes permanently unrecoverable on all three platforms.
- BleepingComputer and The Hacker News publish independent coverage confirming the flaw and its impact on enterprise assets (VM disks, databases, backups).
- Acronis TRU includes VECT 2.0 in its MSP Cybersecurity News Digest, flagging it as a recovery-destroying threat for managed service provider clients.
Detections & IOCs
As of 2026-09-04, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 23 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
RANSOMWARE, HIGH, threat intelligence, cybersecurity, T1195.002, T1552.004, T1110.003, T1552.001, T1543.002, T1021.007, T1021.004, T1021.002, T1688, T1685
