Vexy Ransomware (RaaS) claims Sancity (sancity.in) — Indian real estate/construction group; 130 MB data exfiltration alleged

Key facts for Vexy Sancity real estate extortion

Detection coverage for Vexy Sancity real estate extortion

As of 2026-09-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2352 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Ransomware Service Termination and Event Log Clearing — Post-Exploitation Prep

Detects the rapid termination of critical security, backup, and database services followed by event log clearing — a hallmark of ransomware pre-encryption behavior. Vexy Ransomware's Windows Locker advertises service/process termination to release file locks and maximize encryption coverage, combined with event-log clearing (T1070.001) and self-deletion (T1070.004) to hinder forensic reconstruction.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1489, T1070.001, T1070.004
• Data sources: windows_system_eventlog, windows_security_eventlog, windows_sysmon, process_creation
• Severity: critical
• Confidence: high

Splunk SPL

index=windows (sourcetype="WinEventLog:System" EventCode=7036) OR (sourcetype="WinEventLog:Security" EventCode=1102) OR (sourcetype="WinEventLog:Security" EventCode=1100) 
| eval indicator=case(
    EventCode=7036 AND param2="stopped" AND match(param1,"(?i)(Volume Shadow Copy|VSS|backup|veeam|sophos|sql|memtas|mepocs|DefWatch|ccEvtMgr|ccSetMgr|SavRoam|RTVscan|QBFCService|QBIDPService|YooBackup|YooIT|PDVFSService|BackupExec|WdBoot|WdFilter|WdNisDrv|WdNisSvc|WinDefend|wscsvc|Sense|sppsvc|SecurityHealthService|MsMpSvc|CrowdStrike|CSAgent|CSFalconService|McShield|MfeEERM|SepMasterService|Symantec|TmCCSF|SentinelAgent|CarbonBlack|MSSQLSERVER|SQLWriter|MSExchangeIS|MSExchangeTransport|IISADMIN|W3SVC|WAS)"),"service_stop_targeted",
    EventCode=1102,"security_log_cleared",
    EventCode=1100,"eventlog_service_shutdown",
    1=1,"other"
  )
| where indicator!="other"
| stats values(indicator) as indicators, count by host, _time 
| sort 0 host, _time 
| streamstats time_window=5m values(indicator) as recent_indicators, dc(indicator) as indicator_diversity by host 
| where indicator_diversity >= 2 
| table _time, host, indicators, recent_indicators, indicator_diversity

Microsoft KQL

let StopServices = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("sc.exe", "net.exe", "net1.exe", "taskkill.exe", "powershell.exe", "pwsh.exe", "wmic.exe")
| where ProcessCommandLine has_any ("stop", "Stop-Service", "config")
| extend ServiceTargeted = case(
    ProcessCommandLine has_any ("VSS", "vss", "wbengine", "SDRSVC", "VeeamBackupSvc", "BackupExec", "WinDefend", "MsMpSvc", "SecurityHealthService", "Sense", "WdNisSvc", "CrowdStrike", "CSAgent", "CSFalconService", "McShield", "MfeEERM", "SepMasterService", "Symantec", "SentinelAgent", "CarbonBlack", "MSSQLSERVER", "SQLWriter", "MSExchangeIS", "MSExchangeTransport", "IISADMIN", "W3SVC", "TmCCSF"), "targeted_service",
    ProcessCommandLine has_any ("MSSQL$", "MySQL", "OracleService", "AcronisAgent", "SQLBackupMon"), "targeted_service",
    "other"
  )
| where ServiceTargeted == "targeted_service"
| summarize ServiceStopCount=count(), ServicesTargeted=make_set(ProcessCommandLine), FirstStop=min(Timestamp), LastStop=max(Timestamp) by DeviceName, bin(Timestamp, 5m)
| where ServiceStopCount >= 3
| extend AttackWindowSeconds = datetime_diff('second', LastStop, FirstStop)
| project DeviceName, ServiceStopCount, ServicesTargeted, FirstStop, LastStop, AttackWindowSeconds
| sort by ServiceStopCount desc;
let LogClear = DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName in~ ("wevtutil.exe", "powershell.exe", "pwsh.exe", "wmic.exe") and ProcessCommandLine has_any ("clear-log", "Clear-EventLog", "Clear-WinEvent", "ClearEventLog"))
| project DeviceName, LogClearCmd=ProcessCommandLine, LogClearTime=Timestamp;
StopServices
| join kind=inner LogClear on DeviceName
| where abs(datetime_diff('minute', LogClearTime, FirstStop)) <= 30
| project DeviceName, ServiceStopCount, ServicesTargeted, LogClearCmd, FirstStop, LogClearTime

Sigma

title: Suspicious Service Stop Followed by Event Log Clearing
id: b7e4d3c2-5f6a-4b8d-9e0f-2c3d4e5f6a7b
status: experimental
description: Detects rapid termination of security, backup, or database services followed by event log clearing within a short time window — a common ransomware pre-encryption preparation pattern. Vexy Ransomware's Windows Locker specifically targets these services and clears event logs to hinder forensic analysis.
references:
  - https://attack.mitre.org/techniques/T1489/
  - https://attack.mitre.org/techniques/T1070.001/
  - https://attack.mitre.org/techniques/T1070.004/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-06
tags:
  - attack.impact
  - attack.t1489
  - attack.defense-evasion
  - attack.t1070.001
  - attack.t1070.004
  - attack.ta0005
  - attack.ta0040
  - attack.tool.ransomware
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection_stop:
    Image|endswith:
      - '\sc.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\taskkill.exe'
    CommandLine|contains:
      - 'stop'
      - 'config'
  selection_target:
    CommandLine|contains:
      - 'VSS'
      - 'vss'
      - 'VeeamBackup'
      - 'BackupExec'
      - 'WinDefend'
      - 'MsMpSvc'
      - 'Sense'
      - 'CrowdStrike'
      - 'MSSQLSERVER'
      - 'MSExchangeIS'
      - 'W3SVC'
  selection_clear:
    Image|endswith:
      - '\wevtutil.exe'
      - '\powershell.exe'
      - '\wmic.exe'
    CommandLine|contains:
      - 'clear-log'
      - 'Clear-EventLog'
      - 'ClearEventLog'
  condition: (selection_stop and selection_target) or selection_clear
falsepositives:
  - Legitimate IT maintenance or patching activities that stop services and clear logs
  - Authorized security tool deployments or updates
  - Scheduled maintenance windows
level: critical

Known false positives:

• Legitimate IT maintenance or patching activities that stop services and clear logs
• Authorized security tool deployments or updates
• Scheduled maintenance windows

Tuning notes: Correlate with change management tickets to exclude scheduled maintenance. Tune the service stop threshold (3 events in 5 minutes) based on normal admin activity. Enable alerting for log-clearing events that occur without a corresponding maintenance window.

• 🔒 Anomalous Remote Authentication — Credential Abuse (KQL) · unlock with TL Creds
• 🔒 Ransomware Service Termination and Log Clearing — Post-Exploitation (KQL) · unlock with TL Creds
• 🔒 SMB Lateral Movement and Mass File Encryption — Ransomware Deployment (KQL) · unlock with TL Creds
• 🔒 Password Spray or Brute-Force Authentication Followed by Successful Logon (Sigma) · unlock with TL Creds
• 🔒 Ransomware Service Termination and Event Log Clearing (Sigma) · unlock with TL Creds
• 🔒 SMB Administrative Share Access with Mass File Encryption (Sigma) · unlock with TL Creds
• 🔒 Anomalous Remote Authentication — Credential Abuse Preceding Ransomware Deployment · unlock with TL Creds
• 🔒 SMB Lateral Movement and Mass File Encryption — Ransomware Deployment · unlock with TL Creds

Indicators of compromise for Vexy Sancity real estate extortion

As of 2026-09-06, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-2352.

Sample indicators (3 of 19)

• Domain: sancity[.]in
• Domain: softtouch4u[.]com
• Domain: mcdonalds[.]com[.]ec

Defanged, TLP:CLEAR. Full set of 19 indicators: unlock with TL Creds.

How Vexy Sancity real estate extortion works

The claim is unverified, the leak is pending, and the group's onion site is currently down.

Sancity (sancity.in) is the umbrella brand for a group of active, unlisted public companies incorporated in 2012 in Surat, Gujarat, India. Its principal entity, Sancity Realty India Limited (CIN U45201GJ2012PLC068457, RoC-Ahmedabad), operates in real estate/construction and real-estate marketing and sales, with the group also spanning software (Sancity Soft Touch, softtouch4u.com), travel, media, education, and infrastructure. ransomware.live discovered the Vexy claim against the Sancity sancity.in listing on 2026-09-06 at 15:00 UTC and flags the claim as unverified: the group alludes to 130 MB of exfiltrated data and a pending dark-web leak, with no extortion amount disclosed. Breach House independently tracked a related Vexy listing for Sancity Soft Touch (softtouch4u.com, the group's IT-services arm) dated 2026-09-04, with ~100 MB cited and leak status pending. The victim has not publicly confirmed the incident as of this writing.

Vexy Ransomware is an emerging Ransomware-as-a-Service (RaaS) operation that surfaced in early September 2026 and scaled rapidly, posting at least 7-14 victim listings across India, Brazil, Ecuador, Mexico, and the United States within roughly four days (first estimated attack 2026-09-02; first victims published 2026-09-03; latest observed activity 2026-09-06). The operator, using the handle 'vexys', runs the program on a private invite-only basis through a Tor onion control panel, with RaaS rules published from the ReHub cybercrime forum (effective 2026-09-02): a one-time $200 USD invite fee paid in Bitcoin, an automated wallet/payment pipeline, and three lockers — a Windows Locker, a Linux Locker, and an ESXi Locker — all built in Rust. The advertised tooling uses AES-256 symmetric encryption with RSA key wrapping, targets local disks and network-accessible shares (SMB/NFS and VMware datastores), supports selective file/folder/extension targeting, service/process termination, free-space wiping, event-log and trace removal, self-deletion after execution, persistence control, and printer-based notification delivery. The group operates a single Tor data leak site (vexytsr3chimdz6siwaqi2lvxxwfkxvffkpwyanr2llequ2hkm56jvqd.onion, Apache 2.4.68 on Debian, blog-style), which ransomware-live and Breach House report as down as of 2026-09-06 after 100% uptime in its observed window. Contact channels include a qTox ID.

Vexy is classified by WatchGuard as a 'Data Broker' type using both direct and double extortion. Ransomware.live reports a 42.9% infostealer prevalence among Vexy-attributed victim domains, suggesting credential/stealer-derived initial access is part of the playbook. The threat's targeting skews heavily toward India (3-4 of the group's victims, including Palsana Enviro and Annapurna Fashion) and small-to-medium enterprises across services, retail/e-commerce, manufacturing, transportation, and hospitality (including a high-profile claim against the McDonald's Ecuador franchise operated by Arcos Dorados). Because the Sancity claim is unverified, no malware sample has been publicly analyzed to confirm the advertised encryption or persistence capabilities, and no public ransom note text or wallet address is available; the claim should be treated with caution until independently confirmed.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.002 SMB/Windows Admin Shares

Exfiltration

T1048 Exfiltration Over Alternative Protocol

Defense Evasion

T1070.004 File Deletion

Initial Access

T1078 Valid Accounts

Impact

T1489 Service Stop; T1490 Inhibit System Recovery

Persistence

T1547 Boot or Logon Autostart Execution

Resource Development

T1588.002 Tool

defense-impairment

T1685.005 Clear Windows Event Logs

Remediation for Vexy Sancity real estate extortion

Immediate actions

• Treat the claim as credible pending verification and begin incident-response triage
• Preserve forensic evidence and monitor for publication of allegedly stolen data on the Vexy Tor leak site
• Engage incident response professionals BEFORE initiating any communication with the threat actor
• Run continuous dark-web monitoring for corporate accounts, the Sancity.sanity.in domain, and leaked data
• Check for infostealer-derived credential exposure on sancity.in / softtouch4u.com domains and reset affected accounts

Workarounds

• Restrict external access to RDP/VPN/remote-management interfaces
• Block traffic to the known Vexy onion domain and monitor for associated infrastructure
• Enhance logging on privileged account usage, share access, and authentication anomalies

Longer-term hardening

• Maintain offline, immutable backups and periodically test restoration
• Enforce phishing-resistant multi-factor authentication across all accounts and privileged elevation paths
• Segment networks and restrict SMB/NFS share access to least privilege to blunt lateral spread
• Deploy EDR with behavioral detection for ransomware TTPs: mass file encryption, service/process termination, event-log clearing
• Institute dark-web and brand monitoring plus threat-intelligence integration for emerging RaaS campaigns

Affected and fixed versions

• Sancity Realty India Limited — Sancity corporate group web presence and internal IT (sancity.in)
  Vulnerable versions: unknown
• Sancity Group — Sancity Soft Touch IT-services arm (softtouch4u.com)
  Vulnerable versions: unknown

Timeline of Vexy Sancity real estate extortion

• 2012-01-02 Sancity Realty India Limited incorporated (CIN U45201GJ2012PLC068457, RoC-Ahmedabad); real estate/construction group headquartered in Surat, Gujarat, India.
• 2026-09-02 Vexy RaaS rules effective, published from the locked-ioc-16 cybercrime forum: $200 USD Bitcoin invite code, Windows/Linux/ESXi Rust lockers, AES-256+RSA encryption; first estimated attack (Engefitas, Brazil) dated this day.
• 2026-09-03 Vexy data leak site begins publishing victims; Engefitas (Brazil) and McDonald's Ecuador listed; group discovered and tracked by threat-intelligence platforms (Breach House, WatchGuard, RansomLook, Mallory, ThreatMon).
• 2026-09-04 Vexy lists Sancity Soft Touch (locked-ioc-9), the IT-services arm of the Sancity group, alleging ~100 MB exfiltration with leak status pending; group also lists Annapurna Fashion and Palsana Enviro (PEPL), both Indian companies.
• 2026-09-05 Mega Velocity (Mexico) listed by the group; press coverage of the Sancity Soft Touch claim published (DeXpose via National Cyber Security Consulting; UnderCode News).
• 2026-09-06 Vexy Tor data leak site (locked-ioc-1) reported down after 100% observed uptime; leak for Sancity remains pending; claim unconfirmed by the victim.
• 2026-09-06 ransomware.live discovers the Vexy claim against Sancity (locked-ioc-15) at 15:00 UTC; 130 MB data exfiltration alleged; extortion demand not listed; claim flagged as unverified.

Sources cited for Vexy Sancity real estate extortion

• ransomware.live — Victim profile: Sancity (Vexy Ransomware) ransomware.live · Research · 2026-09-06
• ransomware.live — Group profile: Vexy Ransomware ransomware.live · Research · 2026-09-06
• ransomware.live — Victim profile: Sancity Soft Touch ransomware.live · Research · 2026-09-05
• Breach House — Vexy Ransomware attack on Sancity Soft Touch breach.house · Research · 2026-09-06
• Breach House — Vexy Ransomware group profile breach.house · Research · 2026-09-06
• RansomLook — Vexy RaaS rules (from ReHub) ransomlook.io · Research · 2026-09-02
• WatchGuard Threat Tracker — Vexy Ransomware watchguard.com · Vendor report · 2026-09-06
• Mallory Threat Actor Profile — Vexy Ransomware mallory.ai · Research · 2026-09-05
• HookPhish — Vexy Ransomware hits Engefitas hookphish.com · Blog · 2026-09-04
• National Cyber Security Consulting / DeXpose — Vexy Ransomware strikes Sancity Soft Touch nationalcybersecurity.com · News · 2026-09-05
• UnderCode News — Vexy expands victim list: Sancity Soft Touch and Annapurna Fashion undercodenews.com · News · 2026-09-05
• UnderCode News — Vexy targets Engefitas as new dark-web threat emerges undercodenews.com · News · 2026-09-03
• HackerFeeds — Mega Velocity by Vexy Ransomware hackerfeeds.com · News · 2026-09-05

More in ransomware

• Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing
• BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments
• HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files
• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated
• Queens Public Library Ransomware Attack Disrupts Wi-Fi, On-Site Computers and Digital Services

More from Vexy Ransomware

• Vexy Ransomware claims JHAMF Group (IT services) - 110 GB exfiltrated
• Vexy Ransomware claims System Soft (Bulgaria) - 65 GB exfiltrated
• Vexy Ransomware claims polisee Inc (AI policy intelligence platform) as victim
• Vexy Ransomware Claims Data-Core Systems (dcsdev.org) Victim - 12 GB Exfiltrated
• Vexy Ransomware claims Enchanted Fine Jewellery (India, Retail & E-Commerce) - 34.88 GB exfiltrated
• Vexy Ransomware claims Guarufilme (Brazil) - 60 GB exfiltrated

Previous and next in ransomware

• Aur0ra Ransomware Group: Xray-core C2 Tunneling, Aggressive Email Bombing, and Log-Wiping Double-Extortion Operations Previous report
• Rhysida Ransomware Campaign Targeting German Public Administration (Stuttgart and Berlin, 2026) Next report