# VECT 2.0 Ransomware's Nonce-Reuse Flaw Turns It Into an Accidental Wiper for Files Over 128KB

> VECT 2.0, a cross-platform (Windows/Linux/ESXi) Ransomware-as-a-Service family run as an open BreachForums affiliate program, contains a ChaCha20-IETF implementation bug: for files over 131,072 bytes it splits the file into four chunks, generates four unique nonces, but writes only the last nonce to disk in a shared buffer, permanently destroying roughly 75% of every large file even if the ransom is paid. Its only two confirmed victims were reached through a TeamPCP software-supply-chain compromise of Trivy, Checkmarx KICS, LiteLLM, and the Telnyx SDK.

- **Published:** 2026-08-22T00:00:00Z
- **Last reviewed:** 2026-08-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2116
- **ID:** TL-2026-2116
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** VECT
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

VECT is a Ransomware-as-a-Service (RaaS) operation that first appeared on a Russian-language cybercrime forum on 2025-12-31. In February 2026 it released VECT 2.0, adding native Linux and VMware ESXi builds alongside the original Windows PE64 build; all three platforms share a single ChaCha20-IETF (RFC 8439) encryption engine built on libsodium, despite the operators' marketing claiming authenticated ChaCha20-Poly1305 AEAD.

Check Point Research's technical teardown (published 2026-04-28) found that any file larger than 131,072 bytes (128KB) is split into four equal quarter-size chunks (max 32,768 bytes each). The malware generates a fresh random 12-byte nonce for each chunk, but all four chunk encryptions write their nonce into the same shared in-memory buffer; only the last-generated nonce is ever appended to the encrypted output file. The first three nonces are irretrievably overwritten before being persisted, so three of every four chunks (~75% of a large file's bytes) can never be decrypted again — not by the victim, and not by the VECT operator, even after a ransom payment. Files at or under 128KB are unaffected and fully recoverable. This makes VECT 2.0 a de facto data wiper for the enterprise assets it is actually deployed against: VM disks, database files, backup archives, and any document or mailbox over the threshold.

Beyond the crypto bug, Check Point documented a pattern of unusually low engineering maturity for a ransomware family running an open affiliate program: the advertised `--fast`/`--medium`/`--secure` encryption-mode flags are parsed but never executed; a double-XOR string-obfuscation routine cancels itself out and leaves plaintext command-line arguments and strings in the compiled binaries; 44 anti-analysis/anti-debugger checks (targeting tools such as OllyDbg, x64dbg, WinDbg, IDA, Process Monitor, and Wireshark) are compiled in but never actually invoked; and the malware spawns 6-7x the host's CPU core count in encryption threads, which degrades rather than improves throughput. Check Point assessed the operators as comparatively novice, noting outdated Commonwealth of Independent States (CIS) geofencing logic — which oddly still excludes Ukraine — as a possible sign of AI-assisted code generation or reused legacy code.

On Windows, VECT 2.0 terminates database and productivity processes (sql.exe, oracle.exe, mysqld.exe, excel.exe, winword.exe, outlook.exe, firefox.exe, thunderbird.exe) to release file locks, disrupts services via WMI/DCOM/SMB/scheduled tasks/PowerShell remoting, moves laterally via Group Policy and network share mounting, deletes Volume Shadow Copies, clears Windows event logs, disables Windows Defender, and can force a reboot into Safe Mode (bypassing security tooling that does not load there) before encrypting. On Linux and ESXi, it enumerates and kills 80+ database, backup, hypervisor-management, and security-product services; harvests SSH private keys and known_hosts entries to spray credentials and move laterally over SSH; issues vmware-cmd/VBoxManage/virsh/esxcli/xm/xl commands to disrupt running virtual machines; and destroys 30+ categories of log files and their rotated variants. Both Linux and ESXi builds check host locale/timezone against a CIS-country blacklist (including, unusually, Ukraine) and exit without encrypting if a match is found.

VECT's operators formalized a partnership with the BreachForums marketplace (300,000+ registered users) in March 2026, and between 2026-04-16 and 2026-04-18 a BreachForums administrator using the handle "diencracked" auto-distributed personal VECT affiliate keys to every registered forum member — no proof of skill, prior track record, or capital required. Separately, VECT partnered with the TeamPCP threat group, which between 2026-03-19 and 2026-03-27 compromised the software supply chains of Trivy, Checkmarx KICS, LiteLLM, and the Telnyx Python SDK (stealing CI/CD secrets, cloud tokens, SSH keys, and Kubernetes credentials from each, and reportedly affecting roughly 1,000 downstream SaaS environments). TeamPCP hands compromised organizations reached through these supply-chain footholds to VECT for ransomware deployment and extortion, while TeamPCP itself focuses on initial access and credential harvesting. As of the April 2026 reporting window, VECT's darknet leak site lists exactly two confirmed victims, both reached via the TeamPCP supply-chain compromise chain rather than direct VECT intrusion — consistent with a young RaaS brand that has scaled its affiliate recruitment faster than its actual intrusion or encryption tradecraft.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1552.004 Private Keys
- T1110.003 Password Spraying
- T1552.001 Credentials In Files
- T1543.002 Systemd Service
- T1021.007 Cloud Services
- T1021.004 SSH
- T1021.002 SMB/Windows Admin Shares
- T1688 Safe Mode Boot
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1685.006 Clear Linux or Mac System Logs
- T1027 Obfuscated Files or Information
- T1614.001 System Language Discovery
- T1489 Service Stop
- T1490 Inhibit System Recovery
- T1485 Data Destruction
- T1102.002 Bidirectional Communication

## Sources

- [VECT: Ransomware by design, Wiper by accident](https://research.checkpoint.com/2026/vect-ransomware-by-design-wiper-by-accident/)
- [Broken VECT 2.0 ransomware acts as a data wiper for large files](https://www.bleepingcomputer.com/news/security/broken-vect-20-ransomware-acts-as-a-data-wiper-for-large-files/)
- [VECT 2.0 Ransomware Irreversibly Destroys Files Over 131KB on Windows, Linux, ESXi](https://thehackernews.com/2026/04/vect-20-ransomware-irreversibly.html)
- [MSP Cybersecurity News Digest - May 5, 2026](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-may-5-2026/)
- [TeamPCP Supply Chain Attack Campaign Targets Trivy, Checkmarx (KICS), and LiteLLM](https://arcticwolf.com/resources/blog/teampcp-supply-chain-attack-campaign-targets-trivy-checkmarx-kics-and-litellm-potential-downstream-impact-to-additional-projects/)
- [Weaponizing the Protectors: TeamPCP's Multi-Stage Supply Chain Attack on Security Infrastructure](https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/)
- [Vect formalizes BreachForums and TeamPCP alliance to push model for industrialized ransomware, scale RaaS operations](https://industrialcyber.co/ransomware/vect-formalizes-breachforums-and-teampcp-alliance-to-push-model-for-industrialized-ransomware-scale-raas-operations/)
- [TeamPCP-linked VECT 2.0 ransomware unintentionally destroys files larger than 128 KB](https://www.scworld.com/news/teampcp-linked-vect-2-0-ransomware-unintentionally-destroys-files-larger-than-128-kb)
- [Buggy Vect ransomware is effectively a data wiper, researchers find](https://www.helpnetsecurity.com/2026/04/29/vect-ransomware-bug/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2116