# Vexy Ransomware (RaaS) claims Sancity (sancity.in) — Indian real estate/construction group; 130 MB data exfiltration alleged

> On 2026-09-06, ransomware tracker ransomware.live flagged a leak-site claim by Vexy Ransomware — an emerging Rust-based Ransomware-as-a-Service (RaaS) operation first seen in early September 2026 — against Sancity (sancity.in), an Indian real estate/construction group headquartered in Surat, Gujarat. The group alleges the exfiltration of 130 MB of data and threatens publication on its Tor leak site unless contacted. The claim is unverified, the leak is pending, and the group's onion site is currently down.

- **Published:** 2026-09-06T00:00:00Z
- **Last reviewed:** 2026-09-06T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2352
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-vexy-sancity-real-estate-extortion-tl-2026-2352.webp?v=a51b7dbd (Threadlinqs threat intel: Vexy Ransomware Claims Sancity: Detection & IOCs (TL-2026-2352) — Medium severity, 19 IOCs, 9 detection rules.)
- **ID:** TL-2026-2352
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Vexy Ransomware
- **Detections:** 9 (1 shown free below) · **IOCs:** 19 (3 shown free below)

## Description

Sancity (sancity.in) is the umbrella brand for a group of active, unlisted public companies incorporated in 2012 in Surat, Gujarat, India. Its principal entity, Sancity Realty India Limited (CIN U45201GJ2012PLC068457, RoC-Ahmedabad), operates in real estate/construction and real-estate marketing and sales, with the group also spanning software (Sancity Soft Touch, softtouch4u.com), travel, media, education, and infrastructure. ransomware.live discovered the Vexy claim against the Sancity sancity.in listing on 2026-09-06 at 15:00 UTC and flags the claim as unverified: the group alludes to 130 MB of exfiltrated data and a pending dark-web leak, with no extortion amount disclosed. Breach House independently tracked a related Vexy listing for Sancity Soft Touch (softtouch4u.com, the group's IT-services arm) dated 2026-09-04, with ~100 MB cited and leak status pending. The victim has not publicly confirmed the incident as of this writing.

Vexy Ransomware is an emerging Ransomware-as-a-Service (RaaS) operation that surfaced in early September 2026 and scaled rapidly, posting at least 7-14 victim listings across India, Brazil, Ecuador, Mexico, and the United States within roughly four days (first estimated attack 2026-09-02; first victims published 2026-09-03; latest observed activity 2026-09-06). The operator, using the handle 'vexys', runs the program on a private invite-only basis through a Tor onion control panel, with RaaS rules published from the ReHub cybercrime forum (effective 2026-09-02): a one-time $200 USD invite fee paid in Bitcoin, an automated wallet/payment pipeline, and three lockers — a Windows Locker, a Linux Locker, and an ESXi Locker — all built in Rust. The advertised tooling uses AES-256 symmetric encryption with RSA key wrapping, targets local disks and network-accessible shares (SMB/NFS and VMware datastores), supports selective file/folder/extension targeting, service/process termination, free-space wiping, event-log and trace removal, self-deletion after execution, persistence control, and printer-based notification delivery. The group operates a single Tor data leak site (vexytsr3chimdz6siwaqi2lvxxwfkxvffkpwyanr2llequ2hkm56jvqd.onion, Apache 2.4.68 on Debian, blog-style), which ransomware-live and Breach House report as down as of 2026-09-06 after 100% uptime in its observed window. Contact channels include a qTox ID.

Vexy is classified by WatchGuard as a 'Data Broker' type using both direct and double extortion. Ransomware.live reports a 42.9% infostealer prevalence among Vexy-attributed victim domains, suggesting credential/stealer-derived initial access is part of the playbook. The threat's targeting skews heavily toward India (3-4 of the group's victims, including Palsana Enviro and Annapurna Fashion) and small-to-medium enterprises across services, retail/e-commerce, manufacturing, transportation, and hospitality (including a high-profile claim against the McDonald's Ecuador franchise operated by Arcos Dorados). Because the Sancity claim is unverified, no malware sample has been publicly analyzed to confirm the advertised encryption or persistence capabilities, and no public ransom note text or wallet address is available; the claim should be treated with caution until independently confirmed.

## MITRE ATT&CK

- T1588.002 Tool
- T1078 Valid Accounts
- T1021.002 SMB/Windows Admin Shares
- T1685.005 Clear Windows Event Logs
- T1070.004 File Deletion
- T1547 Boot or Logon Autostart Execution
- T1489 Service Stop
- T1490 Inhibit System Recovery
- T1048 Exfiltration Over Alternative Protocol

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Ransomware Service Termination and Event Log Clearing — Post-Exploitation Prep** (`TL-2026-2352-SPL-002`)

Detects the rapid termination of critical security, backup, and database services followed by event log clearing — a hallmark of ransomware pre-encryption behavior. Vexy Ransomware's Windows Locker advertises service/process termination to release file locks and maximize encryption coverage, combined with event-log clearing (T1070.001) and self-deletion (T1070.004) to hinder forensic reconstruction.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1489, T1070.001, T1070.004
- **Data sources:** windows_system_eventlog, windows_security_eventlog, windows_sysmon, process_creation
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=windows (sourcetype="WinEventLog:System" EventCode=7036) OR (sourcetype="WinEventLog:Security" EventCode=1102) OR (sourcetype="WinEventLog:Security" EventCode=1100) 
| eval indicator=case(
    EventCode=7036 AND param2="stopped" AND match(param1,"(?i)(Volume Shadow Copy|VSS|backup|veeam|sophos|sql|memtas|mepocs|DefWatch|ccEvtMgr|ccSetMgr|SavRoam|RTVscan|QBFCService|QBIDPService|YooBackup|YooIT|PDVFSService|BackupExec|WdBoot|WdFilter|WdNisDrv|WdNisSvc|WinDefend|wscsvc|Sense|sppsvc|SecurityHealthService|MsMpSvc|CrowdStrike|CSAgent|CSFalconService|McShield|MfeEERM|SepMasterService|Symantec|TmCCSF|SentinelAgent|CarbonBlack|MSSQLSERVER|SQLWriter|MSExchangeIS|MSExchangeTransport|IISADMIN|W3SVC|WAS)"),"service_stop_targeted",
    EventCode=1102,"security_log_cleared",
    EventCode=1100,"eventlog_service_shutdown",
    1=1,"other"
  )
| where indicator!="other"
| stats values(indicator) as indicators, count by host, _time 
| sort 0 host, _time 
| streamstats time_window=5m values(indicator) as recent_indicators, dc(indicator) as indicator_diversity by host 
| where indicator_diversity >= 2 
| table _time, host, indicators, recent_indicators, indicator_diversity
```

### Microsoft KQL

```kql
let StopServices = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("sc.exe", "net.exe", "net1.exe", "taskkill.exe", "powershell.exe", "pwsh.exe", "wmic.exe")
| where ProcessCommandLine has_any ("stop", "Stop-Service", "config")
| extend ServiceTargeted = case(
    ProcessCommandLine has_any ("VSS", "vss", "wbengine", "SDRSVC", "VeeamBackupSvc", "BackupExec", "WinDefend", "MsMpSvc", "SecurityHealthService", "Sense", "WdNisSvc", "CrowdStrike", "CSAgent", "CSFalconService", "McShield", "MfeEERM", "SepMasterService", "Symantec", "SentinelAgent", "CarbonBlack", "MSSQLSERVER", "SQLWriter", "MSExchangeIS", "MSExchangeTransport", "IISADMIN", "W3SVC", "TmCCSF"), "targeted_service",
    ProcessCommandLine has_any ("MSSQL$", "MySQL", "OracleService", "AcronisAgent", "SQLBackupMon"), "targeted_service",
    "other"
  )
| where ServiceTargeted == "targeted_service"
| summarize ServiceStopCount=count(), ServicesTargeted=make_set(ProcessCommandLine), FirstStop=min(Timestamp), LastStop=max(Timestamp) by DeviceName, bin(Timestamp, 5m)
| where ServiceStopCount >= 3
| extend AttackWindowSeconds = datetime_diff('second', LastStop, FirstStop)
| project DeviceName, ServiceStopCount, ServicesTargeted, FirstStop, LastStop, AttackWindowSeconds
| sort by ServiceStopCount desc;
let LogClear = DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName in~ ("wevtutil.exe", "powershell.exe", "pwsh.exe", "wmic.exe") and ProcessCommandLine has_any ("clear-log", "Clear-EventLog", "Clear-WinEvent", "ClearEventLog"))
| project DeviceName, LogClearCmd=ProcessCommandLine, LogClearTime=Timestamp;
StopServices
| join kind=inner LogClear on DeviceName
| where abs(datetime_diff('minute', LogClearTime, FirstStop)) <= 30
| project DeviceName, ServiceStopCount, ServicesTargeted, LogClearCmd, FirstStop, LogClearTime
```

### Sigma

```yaml
title: Suspicious Service Stop Followed by Event Log Clearing
id: b7e4d3c2-5f6a-4b8d-9e0f-2c3d4e5f6a7b
status: experimental
description: Detects rapid termination of security, backup, or database services followed by event log clearing within a short time window — a common ransomware pre-encryption preparation pattern. Vexy Ransomware's Windows Locker specifically targets these services and clears event logs to hinder forensic analysis.
references:
  - https://attack.mitre.org/techniques/T1489/
  - https://attack.mitre.org/techniques/T1070.001/
  - https://attack.mitre.org/techniques/T1070.004/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-06
tags:
  - attack.impact
  - attack.t1489
  - attack.defense-evasion
  - attack.t1070.001
  - attack.t1070.004
  - attack.ta0005
  - attack.ta0040
  - attack.tool.ransomware
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection_stop:
    Image|endswith:
      - '\sc.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\taskkill.exe'
    CommandLine|contains:
      - 'stop'
      - 'config'
  selection_target:
    CommandLine|contains:
      - 'VSS'
      - 'vss'
      - 'VeeamBackup'
      - 'BackupExec'
      - 'WinDefend'
      - 'MsMpSvc'
      - 'Sense'
      - 'CrowdStrike'
      - 'MSSQLSERVER'
      - 'MSExchangeIS'
      - 'W3SVC'
  selection_clear:
    Image|endswith:
      - '\wevtutil.exe'
      - '\powershell.exe'
      - '\wmic.exe'
    CommandLine|contains:
      - 'clear-log'
      - 'Clear-EventLog'
      - 'ClearEventLog'
  condition: (selection_stop and selection_target) or selection_clear
falsepositives:
  - Legitimate IT maintenance or patching activities that stop services and clear logs
  - Authorized security tool deployments or updates
  - Scheduled maintenance windows
level: critical
```

**Known false positives:**

- Legitimate IT maintenance or patching activities that stop services and clear logs
- Authorized security tool deployments or updates
- Scheduled maintenance windows

**Tuning notes:** Correlate with change management tickets to exclude scheduled maintenance. Tune the service stop threshold (3 events in 5 minutes) based on normal admin activity. Enable alerting for log-clearing events that occur without a corresponding maintenance window.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Anomalous Remote Authentication — Credential Abuse (KQL) (locked: unlock with TL Creds)
- Ransomware Service Termination and Log Clearing — Post-Exploitation (KQL) (locked: unlock with TL Creds)
- SMB Lateral Movement and Mass File Encryption — Ransomware Deployment (KQL) (locked: unlock with TL Creds)
- Password Spray or Brute-Force Authentication Followed by Successful Logon (Sigma) (locked: unlock with TL Creds)
- Ransomware Service Termination and Event Log Clearing (Sigma) (locked: unlock with TL Creds)
- SMB Administrative Share Access with Mass File Encryption (Sigma) (locked: unlock with TL Creds)
- Anomalous Remote Authentication — Credential Abuse Preceding Ransomware Deployment (locked: unlock with TL Creds)
- SMB Lateral Movement and Mass File Encryption — Ransomware Deployment (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 19)

Defanged, TLP:CLEAR.

- Domain: `sancity[.]in`
- Domain: `softtouch4u[.]com`
- Domain: `mcdonalds[.]com[.]ec`

Full set of 19 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [ransomware.live — Victim profile: Sancity (Vexy Ransomware)](https://www.ransomware.live/id/U2FuY2l0eUBWZXh5IFJhbnNvbXdhcmU=)
- [ransomware.live — Group profile: Vexy Ransomware](https://www.ransomware.live/group/Vexy%20Ransomware)
- [ransomware.live — Victim profile: Sancity Soft Touch](https://www.ransomware.live/id/U2FuY2l0eSBTb2Z0IFRvdWNoQFZleHkgUmFuc29td2FyZQ)
- [Breach House — Vexy Ransomware attack on Sancity Soft Touch](https://breach.house/ransomware-victim/vexy-ransomware-sancity-soft-touch-iHFDhPpfFeu6)
- [Breach House — Vexy Ransomware group profile](https://breach.house/groups/vexy-ransomware)
- [RansomLook — Vexy RaaS rules (from ReHub)](https://www.ransomlook.io/group/vexy/raas-rules)
- [WatchGuard Threat Tracker — Vexy Ransomware](https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/vexy)
- [Mallory Threat Actor Profile — Vexy Ransomware](https://mallory.ai/actors/01a06838-9c7c-7366-8885-47ba858377f9)
- [National Cyber Security Consulting / DeXpose — Vexy Ransomware strikes Sancity Soft Touch](https://nationalcybersecurity.com/vexy-ransomware-strikes-sancity-soft-touch-ransomware-cybercrime/)
- [UnderCode News — Vexy expands victim list: Sancity Soft Touch and Annapurna Fashion](https://undercodenews.com/vexy-ransomware-expands-its-victim-list-targeting-sancity-soft-touch-and-annapurna-fashion-video/)
- [UnderCode News — Vexy targets Engefitas as new dark-web threat emerges](https://undercodenews.com/vexy-ransomware-targets-engefitas-as-a-new-dark-web-threat-emerges-video/)
- [HackerFeeds — Mega Velocity by Vexy Ransomware](https://hackerfeeds.com/ransomware/mega-velocity-by-vexy-ransomware-4ha4)
- [HookPhish — Vexy Ransomware hits Engefitas](https://www.hookphish.com/blog/ransomware-group-vexy-ransomware-hits-engefitas/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2352