Vexy Ransomware hits Mega Velocity — 46.68 GB exfiltrated, double extortion

Key facts for Mega Velocity Vexy ransomware

Detection coverage for Mega Velocity Vexy ransomware

As of 2026-09-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2363 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Vexy Ransomware Shadow Copy and System Recovery Sabotage

Detects execution of vssadmin (delete shadows), wbadmin, diskpart, and wevtutil for event log and recovery data deletion prior to Vexy ransomware encryption.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1490, T1070, T1485
• Data sources: Windows Security EventID 4688, Sysmon EventID 1
• Severity: high
• Confidence: high

Splunk SPL

index=windows sourcetype="WinEventLog:Security" EventCode=4688 (ParentImage="*\\cmd.exe" OR ParentImage="*\\powershell.exe") (Image="*\\vssadmin.exe" OR Image="*\\wbadmin.exe" OR Image="*\\diskpart.exe" OR Image="*\\wevtutil.exe") (CommandLine="*delete shadows*" OR CommandLine="*delete catalog*" OR CommandLine="*delete backup*" OR CommandLine="*cl*" OR CommandLine="*clear-log*" OR CommandLine="*diskpart*clean*" OR CommandLine="*diskpart*delete*") | stats count by host, user, Image, CommandLine | where count > 3 | sort - count

Microsoft KQL

SecurityEvent
| where TimeGenerated > ago(1d)
| where EventID == 4688
| where ParentProcessName in~ ("cmd.exe", "powershell.exe")
| where ProcessName in~ ("vssadmin.exe", "wbadmin.exe", "diskpart.exe", "wevtutil.exe")
| where CommandLine has_any ("delete shadows", "delete catalog", "delete backup", "cl", "clear-log", "diskpart clean")
| summarize count_ = count() by Computer, Account, ProcessName, CommandLine
| where count_ > 3
| sort by count_ desc

Sigma

title: Vexy Ransomware Shadow Copy and Recovery Sabotage
id: 8d9f3b2e-4c5d-4b92-c56f-0f7d2b9e56f3
status: experimental
description: Detects execution of tools used to delete shadow copies, backups, and event logs
  consistent with Vexy ransomware post-exploitation system recovery sabotage
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://attack.mitre.org/techniques/T1070/
  - https://attack.mitre.org/techniques/T1485/
author: AII-Detector - Threadlinqs Intelligence
date: 2026-09-06
tags:
  - attack.impact
  - attack.T1490
  - attack.T1070
  - attack.T1485
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - vssadmin.exe
      - wbadmin.exe
      - diskpart.exe
      - wevtutil.exe
    CommandLine|contains:
      - delete shadows
      - delete catalog
      - cl
  condition: selection
falsepositives:
  - Authorized backup administrators during disaster recovery testing
  - Scheduled maintenance scripts with explicit change control
level: high

Known false positives:

• Authorized backup administrators during disaster recovery testing
• Scheduled maintenance scripts under change control

Tuning notes: Baseline normal backup rotation and maintenance window activity. Whitelist known backup tools and administrators to reduce false positives.

• 🔒 Vexy Ransomware Security Tool Tampering and Binary Execution · unlock with TL Creds
• 🔒 Vexy Ransomware ESXi Datastore Encryption and Log Clearing · unlock with TL Creds
• 🔒 Vexy Ransomware Tor Network Detection and Data Exfiltration · unlock with TL Creds
• 🔒 Vexy Ransomware Binary Execution via Sigma · unlock with TL Creds
• 🔒 Vexy Ransomware Free Space Wiping and Desktop Defacement · unlock with TL Creds
• 🔒 Vexy Ransomware Print Ransom Note and qTox C2 Communication · unlock with TL Creds
• 🔒 Vexy Ransomware Service Termination Pre-Encryption · unlock with TL Creds
• 🔒 Vexy Ransomware SMB and Tor C2 Activity · unlock with TL Creds

Indicators of compromise for Mega Velocity Vexy ransomware

As of 2026-09-06, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-2363.

Sample indicators (1 of 7)

• Domain: vexytsr3chimdz6siwaqi2lvxxwfkxvffkpwyanr2llequ2hkm56jvqd[.]onion

Defanged, TLP:CLEAR. Full set of 7 indicators: unlock with TL Creds.

How Mega Velocity Vexy ransomware works

Vexy has rapidly accumulated 7-10 published victims across India, the Americas, and multiple sectors since early September 2026, operating a low-barrier affiliate program ($200 BTC invite fee) with cross-platform lockers for Windows, Linux, and ESXi.

Vexy Ransomware emerged in early September 2026 as a new Ransomware-as-a-Service (RaaS) operation, first advertised on dark web cybercrime forums by a threat actor using the handle 'vexys'. The program was published by 'ReHub' with affiliate rules effective September 2, 2026. Vexy targets affiliates with a low $200 one-time Bitcoin entry fee and offer lockers written in Rust for Windows, Linux, and ESXi VMware environments.

The Windows locker uses AES-256 for bulk file encryption with RSA key wrapping, targets local disks and network shares (SMB), terminates specified services and processes (likely database, backup, and email services to unlock files for encryption), wipes free space after encryption, and self-deletes after execution. It also delivers ransom notes via network printers and customizes desktop wallpaper/icons. The Linux locker provides equivalent capabilities including SMB/NFS network share encryption. The ESXi locker performs stealth encryption of VM datastores, terminates VMware services, and clears event logs before self-deletion.

Affiliates access a Tor onion-based control panel featuring build configuration, real-time analytics, client communication/negotiation tools, 24/7 support, and a multilingual interface. Communication is available via qTox. The group maintains a Tor leak site at vaxytsr3chimdz6siwaqi2lvxxwfkxvffkpwyanr2llequ2hkm56jvqd.onion where victim data is published as part of its double-extortion model.

On September 5, 2026, Vexy claimed Mega Velocity (megavelocity.net), a New Delhi-based private technology company incorporated in 2013 providing software development, maintenance, web design, and Internet/hosting services (CIN: U72200DL2013PTC249231; directors: Deepak Kumar Singh and Aartee Aggarwal). The group alleges exfiltration of 46.68 GB of data. The breach was discovered approximately 1 hour and 10 minutes after the claimed attack time. This was Vexy's 6th published victim per the ThreatCluster ransomware leak-site dataset.

Vexy has shown rapid expansion with victims in India (Annapurna Fashion, Palsana Enviro, Mega Velocity), Brazil (Engefitas), Ecuador (McDonald's Ecuador franchise), and the United States (Sancity Soft Touch), spanning manufacturing, hospitality/food service, retail/e-commerce, environmental services, and IT/technology sectors. India is the most targeted country with at least 4 victims. The group's Tor leak site has shown intermittent availability (~50% uptime), consistent with an emerging operation.

Initial access vectors for Vexy intrusions have not been publicly documented as of this analysis. No specific CVEs, phishing campaigns, or vulnerability exploits have been attributed to the group. The Rust codebase aligns with a broader industry trend toward memory-safe, cross-compilable ransomware that resists reverse engineering (paralleling DeadLock, Kyber, and other Rust-based ransomware families). No public decryptor, full reverse-engineering report, YARA rules, Sigma rules, or Snort signatures have been published for Vexy as of September 6, 2026.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021 Remote Services

Exfiltration

T1048 Exfiltration Over Alternative Protocol

Execution

T1059 Command and Scripting Interpreter

Command and Control

T1090 Proxy

Impact

T1485 Data Destruction; T1489 Service Stop; T1490 Inhibit System Recovery; T1491 Defacement

Resource Development

T1588 Obtain Capabilities

defense-impairment

T1685 Disable or Modify Tools

Remediation for Mega Velocity Vexy ransomware

Immediate actions

• Isolate affected systems from the network to prevent lateral spread
• Identify and block Tor exit nodes and known onion service access at network perimeter
• Scan for Vexy ransomware indicators: service/process termination events, shadow copy deletion, and free space wiping activity
• Preserve forensic data including event logs, memory captures, and encrypted file samples
• Reset all credentials for accounts that may have been compromised
• Engage incident response team for containment and eradication

Workarounds

• Restrict SMB (port 445) and NFS (port 2049) traffic to only necessary systems
• Monitor for wevtutil or equivalent event log clearing commands on critical systems
• Enable verbose process creation logging (Event ID 4688) with command-line auditing
• Deploy PowerShell logging and script block logging across Windows estate
• Restrict printer access for unauthorized network-based print jobs

Longer-term hardening

• Implement behavioral detection rules for Rust-based ransomware patterns including mass file encryption with uncommon extensions
• Deploy EDR with service/process termination monitoring and alerting
• Implement network segmentation to restrict SMB and NFS share access to authorized systems only
• Deploy Tor network detection and alerting at perimeter gateways
• Establish air-gapped backup strategy with immutable storage
• Implement VM-level snapshots and backup verification for ESXi environments

Affected and fixed versions

• Mega Velocity — Corporate IT Infrastructure
  Vulnerable versions: megavelocity.net systems

Timeline of Mega Velocity Vexy ransomware

• 2026-09-02 Vexy RaaS affiliate rules published with effective date; first victim claimed (Engefitas, Brazil, adhesive tape manufacturer)
• 2026-09-03 McDonald's Ecuador (Arcos Dorados franchise) claimed as victim; Vexy RaaS advertised on dark web cybercrime forums by threat actor 'vexys' recruiting affiliates
• 2026-09-04 Multiple victims posted on Vexy Tor leak site: Annapurna Fashion (India, textile retail), Palsana Enviro PEPL (India, environmental services), and Sancity Soft Touch (US, IT services)
• 2026-09-05 Vexy posts Mega Velocity on Tor leak site as 6th known victim per ThreatCluster dataset; sector classified as transportation/technology
• 2026-09-05 Mega Velocity victim page discovered and indexed by Ransomware.live at 17:22 UTC, approximately 1 hour 10 minutes after claimed attack time of 16:12 UTC
• 2026-09-05 Mega Velocity (MEGA VELOCITY PVT LTD), a New Delhi-based software/hosting provider, breached by Vexy affiliates; 46.68 GB of data allegedly exfiltrated
• 2026-09-06 Breach House tracking 16 published victim entries (~7-9 unique organizations) across 4 countries; India identified as top targeted country with 4+ victims; RansomLook reports 8 posts on Vexy leak site spanning Sept 3-6

Sources cited for Mega Velocity Vexy ransomware

• Vexy Ransomware (Mallory.ai) mallory.ai · Research · 2026-09-06
• ThreatCluster Ransomware Leak-Site Victims Dataset (HuggingFace) huggingface.co · Research · 2026-09-06
• Ransomware Group Vexy Ransomware Hits Mega Velocity (HookPhish) hookphish.com · Blog · 2026-09-05
• Vexy Ransomware Emerges on Dark Web as New RaaS (UnderCode News) undercodenews.com · News · 2026-09-05
• Vexy Ransomware — Mega Velocity victim disclosure (Ransomware.live) ransomware.live · Ransomware-tracker · 2026-09-05
• Vexy Ransomware Tracker (WatchGuard) watchguard.com · Ransomware-tracker · 2026-09-05
• Vexy Ransomware (Breach House) breach.house · Ransomware-tracker · 2026-09-05
• Vexy Ransomware Group Page (RansomLook) ransomlook.io · Ransomware-tracker · 2026-09-06
• Vexy RaaS Affiliate Rules (RansomLook) ransomlook.io · Ransomware-tracker · 2026-09-06
• Mega Velocity by Vexy Ransomware (HackerFeeds) hackerfeeds.com · Ransomware-tracker · 2026-09-05

More in ransomware

• Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing
• BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments
• HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files
• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated
• Queens Public Library Ransomware Attack Disrupts Wi-Fi, On-Site Computers and Digital Services

More from Vexy Ransomware

• Vexy Ransomware claims JHAMF Group (IT services) - 110 GB exfiltrated
• Vexy Ransomware claims System Soft (Bulgaria) - 65 GB exfiltrated
• Vexy Ransomware claims polisee Inc (AI policy intelligence platform) as victim
• Vexy Ransomware Claims Data-Core Systems (dcsdev.org) Victim - 12 GB Exfiltrated
• Vexy Ransomware claims Enchanted Fine Jewellery (India, Retail & E-Commerce) - 34.88 GB exfiltrated
• Vexy Ransomware claims Guarufilme (Brazil) - 60 GB exfiltrated

Previous and next in ransomware

• Rhysida Ransomware Campaign Targeting German Public Administration (Stuttgart and Berlin, 2026) Previous report
• DragonForce Ransomware Attack on RubberMill, Inc. — ~340GB Data Exfiltration Including PII, Credentials, CAD Files with Defense Mil-Spec References Next report