VECT 2.0 Ransomware's Nonce-Reuse Flaw Turns It Into an Accidental Wiper for Files Over 128KB
VECT 2.0 Ransomware's Nonce-Reuse Flaw Turns It Into an (TL-2026-2116) is a high-severity ransomware operation, first published 2026-08-22. It is attributed to VECT with low confidence, affects Microsoft Windows, maps to 18 MITRE ATT&CK techniques (T1021.002, T1021.004, T1021.007), and is covered by 9 detection rules and 23 indicators of compromise.
Key facts for TL-2026-2116
- Threat ID
- TL-2026-2116
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-08-22
- Last reviewed
- 2026-08-22
- Attribution
- VECT
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, cloud infrastructure, managed service providers, enterprise it
- Target regions
- Global (geofencing excludes CIS countries, including Ukraine)
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in VECT 2.0 Ransomware's Nonce-Reuse Flaw Turns It Into an
Malware and tooling: vect
VECT 2.0, a cross-platform (Windows/Linux/ESXi) Ransomware-as-a-Service family run as an open BreachForums affiliate program, contains a ChaCha20-IETF implementation bug: for files over 131,072 bytes it splits the file into four chunks, generates four unique nonces, but writes only the last nonce to disk in a shared buffer, permanently destroying roughly 75% of every large file even if the ransom is paid. Its only two confirmed victims were reached through a TeamPCP software-supply-chain compromise of Trivy, Checkmarx KICS, LiteLLM, and the Telnyx SDK.
How VECT 2.0 Ransomware's Nonce-Reuse Flaw Turns It Into an works
VECT is a Ransomware-as-a-Service (RaaS) operation that first appeared on a Russian-language cybercrime forum on 2025-12-31. In February 2026 it released VECT 2.0, adding native Linux and VMware ESXi builds alongside the original Windows PE64 build; all three platforms share a single ChaCha20-IETF (RFC 8439) encryption engine built on libsodium, despite the operators' marketing claiming authenticated ChaCha20-Poly1305 AEAD.
Check Point Research's technical teardown (published 2026-04-28) found that any file larger than 131,072 bytes (128KB) is split into four equal quarter-size chunks (max 32,768 bytes each). The malware generates a fresh random 12-byte nonce for each chunk, but all four chunk encryptions write their nonce into the same shared in-memory buffer; only the last-generated nonce is ever appended to the encrypted output file. The first three nonces are irretrievably overwritten before being persisted, so three of every four chunks (~75% of a large file's bytes) can never be decrypted again — not by the victim, and not by the VECT operator, even after a ransom payment. Files at or under 128KB are unaffected and fully recoverable. This makes VECT 2.0 a de facto data wiper for the enterprise assets it is actually deployed against: VM disks, database files, backup archives, and any document or mailbox over the threshold.
Beyond the crypto bug, Check Point documented a pattern of unusually low engineering maturity for a ransomware family running an open affiliate program: the advertised `--fast`/`--medium`/`--secure` encryption-mode flags are parsed but never executed; a double-XOR string-obfuscation routine cancels itself out and leaves plaintext command-line arguments and strings in the compiled binaries; 44 anti-analysis/anti-debugger checks (targeting tools such as OllyDbg, x64dbg, WinDbg, IDA, Process Monitor, and Wireshark) are compiled in but never actually invoked; and the malware spawns 6-7x the host's CPU core count in encryption threads, which degrades rather than improves throughput. Check Point assessed the operators as comparatively novice, noting outdated Commonwealth of Independent States (CIS) geofencing logic — which oddly still excludes Ukraine — as a possible sign of AI-assisted code generation or reused legacy code.
On Windows, VECT 2.0 terminates database and productivity processes (sql.exe, oracle.exe, mysqld.exe, excel.exe, winword.exe, outlook.exe, firefox.exe, thunderbird.exe) to release file locks, disrupts services via WMI/DCOM/SMB/scheduled tasks/PowerShell remoting, moves laterally via Group Policy and network share mounting, deletes Volume Shadow Copies, clears Windows event logs, disables Windows Defender, and can force a reboot into Safe Mode (bypassing security tooling that does not load there) before encrypting. On Linux and ESXi, it enumerates and kills 80+ database, backup, hypervisor-management, and security-product services; harvests SSH private keys and known_hosts entries to spray credentials and move laterally over SSH; issues vmware-cmd/VBoxManage/virsh/esxcli/xm/xl commands to disrupt running virtual machines; and destroys 30+ categories of log files and their rotated variants. Both Linux and ESXi builds check host locale/timezone against a CIS-country blacklist (including, unusually, Ukraine) and exit without encrypting if a match is found.
VECT's operators formalized a partnership with the BreachForums marketplace (300,000+ registered users) in March 2026, and between 2026-04-16 and 2026-04-18 a BreachForums administrator using the handle "diencracked" auto-distributed personal VECT affiliate keys to every registered forum member — no proof of skill, prior track record, or capital required. Separately, VECT partnered with the TeamPCP threat group, which between 2026-03-19 and 2026-03-27 compromised the software supply chains of Trivy, Checkmarx KICS, LiteLLM, and the Telnyx Python SDK (stealing CI/CD secrets, cloud tokens, SSH keys, and Kubernetes credentials from each, and reportedly affecting roughly 1,000 downstream SaaS environments). TeamPCP hands compromised organizations reached through these supply-chain footholds to VECT for ransomware deployment and extortion, while TeamPCP itself focuses on initial access and credential harvesting. As of the April 2026 reporting window, VECT's darknet leak site lists exactly two confirmed victims, both reached via the TeamPCP supply-chain compromise chain rather than direct VECT intrusion — consistent with a young RaaS brand that has scaled its affiliate recruitment faster than its actual intrusion or encryption tradecraft.
MITRE ATT&CK techniques used in TL-2026-2116
Lateral Movement
T1021.002 SMB/Windows Admin Shares; T1021.004 SSH; T1021.007 Cloud Services
Defense Evasion
T1027 Obfuscated Files or Information
Command and Control
T1102.002 Bidirectional Communication
Credential Access
T1110.003 Password Spraying; T1552.001 Credentials In Files; T1552.004 Private Keys
Initial Access
T1195.002 Compromise Software Supply Chain
Impact
T1485 Data Destruction; T1489 Service Stop; T1490 Inhibit System Recovery
Persistence
Discovery
T1614.001 System Language Discovery
defense-impairment
T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs; T1685.006 Clear Linux or Mac System Logs; T1688 Safe Mode Boot
Affected products and versions in VECT 2.0 Ransomware's Nonce-Reuse Flaw Turns It Into an
- Microsoft — Windows
Vulnerable versions: Any Windows host targeted by the VECT 2.0 PE64 x86-64 build, when it processes files over 131,072 bytes - N/A (cross-distribution) — Linux
Vulnerable versions: Any Linux host targeted by the VECT 2.0 ELF64 x86-64 build, when it processes files over 131,072 bytes - Broadcom (VMware) — VMware ESXi
Vulnerable versions: Any ESXi host (/vmfs/volumes) targeted by the VECT 2.0 ELF64 x86-64 build, when it processes files over 131,072 bytes
Remediation for VECT 2.0 Ransomware's Nonce-Reuse Flaw Turns It Into an
Immediate actions
- Treat any VECT/.vect encounter as a destructive wiper event, not a recoverable ransomware incident, for every file over 128KB — do not pay the ransom expecting large-file recovery.
- Isolate affected Windows, Linux, and ESXi hosts immediately; VM disks, database files, and backup archives on those hosts should be assumed permanently destroyed once encryption completes.
- Rotate all CI/CD secrets, cloud access tokens, SSH keys, and Kubernetes credentials for any environment that consumed Trivy, Checkmarx KICS, LiteLLM (1.82.7/1.82.8), or the Telnyx PyPI package during the March 2026 compromise window.
- Block outbound access to known TeamPCP C2 domains/IPs and the VECT darknet leak site at the perimeter.
Workarounds
- Enforce least-privilege on CI/CD service accounts and rotate credentials on any schedule/breach suspicion — TeamPCP's initial foothold was an incompletely rotated credential from a prior minor breach.
- There is no vendor patch: this is a design/implementation defect in third-party ransomware, not a vulnerability in defender-controlled software.
Longer-term hardening
- Maintain offline/immutable, air-gapped backups that are never reachable from production hosts, since VECT's flaw means on-box or network-reachable backups may be irrecoverably destroyed rather than merely encrypted.
- Pin and verify checksums/signatures for third-party CI/CD tooling and container images (Trivy, KICS, LiteLLM, Telnyx SDK, etc.) rather than trusting floating tags or auto-updated packages.
- Deploy EDR/behavioral detection that does not depend on booting into normal mode only — VECT's Windows variant can force a Safe Mode reboot specifically to evade tooling that doesn't load there.
- Monitor for anomalous mass process termination (database/office processes), VSS deletion, and event-log clearing as leading indicators ahead of encryption.
Weaknesses (CWE) in VECT 2.0 Ransomware's Nonce-Reuse Flaw Turns It Into an
CWE-323
Timeline of VECT 2.0 Ransomware's Nonce-Reuse Flaw Turns It Into an
- VECT ransomware-as-a-service debuts on a Russian-language cybercrime forum.
- VECT 2.0 is released, adding Linux and VMware ESXi builds alongside the existing Windows variant, sharing the same flawed ChaCha20-IETF chunked-encryption engine across all three platforms.
- TeamPCP and VECT announce a formal partnership on BreachForums: TeamPCP supplies compromised supply-chain victims for VECT to deploy ransomware against and extort.
- TeamPCP compromises Aqua Security's Trivy vulnerability scanner (binary, GitHub Actions workflow, and container images) via an incompletely rotated aqua-bot service-account credential.
- TeamPCP uses credentials stolen from the Trivy compromise to push malicious updates to Checkmarx KICS.
- TeamPCP publishes malicious LiteLLM versions 1.82.7 and 1.82.8 directly to PyPI using stolen CI/CD credentials.
- TeamPCP publishes a malicious release of the Telnyx SDK to PyPI, the fourth package compromised in the campaign.
- A BreachForums administrator using the handle "diencracked" begins auto-distributing personal VECT affiliate keys to every registered forum member, opening the RaaS to 300,000+ potential affiliates with no vetting.
- Check Point Research publishes "VECT: Ransomware by design, Wiper by accident," documenting the nonce-buffer-overwrite flaw that makes files over 131,072 bytes permanently unrecoverable on all three platforms.
- BleepingComputer and The Hacker News publish independent coverage confirming the flaw and its impact on enterprise assets (VM disks, databases, backups).
- Acronis TRU includes VECT 2.0 in its MSP Cybersecurity News Digest, flagging it as a recovery-destroying threat for managed service provider clients.
Sources cited for VECT 2.0 Ransomware's Nonce-Reuse Flaw Turns It Into an
- VECT: Ransomware by design, Wiper by accident
- Broken VECT 2.0 ransomware acts as a data wiper for large files
- VECT 2.0 Ransomware Irreversibly Destroys Files Over 131KB on Windows, Linux, ESXi
- MSP Cybersecurity News Digest - May 5, 2026
- TeamPCP Supply Chain Attack Campaign Targets Trivy, Checkmarx (KICS), and LiteLLM
- Weaponizing the Protectors: TeamPCP's Multi-Stage Supply Chain Attack on Security Infrastructure
- Vect formalizes BreachForums and TeamPCP alliance to push model for industrialized ransomware, scale RaaS operations
- TeamPCP-linked VECT 2.0 ransomware unintentionally destroys files larger than 128 KB
- Buggy Vect ransomware is effectively a data wiper, researchers find
Threats related to VECT 2.0 Ransomware's Nonce-Reuse Flaw Turns It Into an
- VECT 2.0 / DEVMAN 3.0 Ransomware — Design-Flawed ChaCha20 Encryption Irreversibly Destroys Files Over 128KB on Windows, Linux & ESXi (Wiper by Accident)
- VECT Ransomware 2.0 — Russian-Speaking RaaS with ChaCha20 Buffer-Reuse Bug Producing Permanent Data Destruction (Wiper-by-Accident) Across Windows, Linux, and ESXi
- Ransomware Groups Exploit Citrix Bleed 2 (CVE-2025-5777) and Kontron Driver BYOVD for Access and Privilege Escalation
- TeamPCP Partners With Vect Ransomware Group to Escalate Cross-Ecosystem Open Source Supply Chain Attacks
- GitHub and PyPI Add Time-Based Defenses Against Supply-Chain Attacks
- Akira Ransomware Reboots Victims into Safe Mode to Blind EDR and Windows Defender
Detection coverage for TL-2026-2116
As of 2026-08-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2116 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-2116
3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.