# Vexy Ransomware hits Mega Velocity — 46.68 GB exfiltrated, double extortion

> Vexy Ransomware, an emerging Rust-based Ransomware-as-a-Service (RaaS) group first observed in September 2026, has claimed the compromise of Mega Velocity (MEGA VELOCITY PVT LTD), a New Delhi-based software publishing and IT services provider. The group claims exfiltration of 46.68 GB of data and has posted the victim on its Tor leak site as part of a double-extortion campaign. Vexy has rapidly accumulated 7-10 published victims across India, the Americas, and multiple sectors since early September 2026, operating a low-barrier affiliate program ($200 BTC invite fee) with cross-platform lockers for Windows, Linux, and ESXi.

- **Published:** 2026-09-06T00:00:00Z
- **Last reviewed:** 2026-09-06T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2363
- **ID:** TL-2026-2363
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Vexy Ransomware
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Vexy Ransomware emerged in early September 2026 as a new Ransomware-as-a-Service (RaaS) operation, first advertised on dark web cybercrime forums by a threat actor using the handle 'vexys'. The program was published by 'ReHub' with affiliate rules effective September 2, 2026. Vexy targets affiliates with a low $200 one-time Bitcoin entry fee and offer lockers written in Rust for Windows, Linux, and ESXi VMware environments.

The Windows locker uses AES-256 for bulk file encryption with RSA key wrapping, targets local disks and network shares (SMB), terminates specified services and processes (likely database, backup, and email services to unlock files for encryption), wipes free space after encryption, and self-deletes after execution. It also delivers ransom notes via network printers and customizes desktop wallpaper/icons. The Linux locker provides equivalent capabilities including SMB/NFS network share encryption. The ESXi locker performs stealth encryption of VM datastores, terminates VMware services, and clears event logs before self-deletion.

Affiliates access a Tor onion-based control panel featuring build configuration, real-time analytics, client communication/negotiation tools, 24/7 support, and a multilingual interface. Communication is available via qTox. The group maintains a Tor leak site at vaxytsr3chimdz6siwaqi2lvxxwfkxvffkpwyanr2llequ2hkm56jvqd.onion where victim data is published as part of its double-extortion model.

On September 5, 2026, Vexy claimed Mega Velocity (megavelocity.net), a New Delhi-based private technology company incorporated in 2013 providing software development, maintenance, web design, and Internet/hosting services (CIN: U72200DL2013PTC249231; directors: Deepak Kumar Singh and Aartee Aggarwal). The group alleges exfiltration of 46.68 GB of data. The breach was discovered approximately 1 hour and 10 minutes after the claimed attack time. This was Vexy's 6th published victim per the ThreatCluster ransomware leak-site dataset.

Vexy has shown rapid expansion with victims in India (Annapurna Fashion, Palsana Enviro, Mega Velocity), Brazil (Engefitas), Ecuador (McDonald's Ecuador franchise), and the United States (Sancity Soft Touch), spanning manufacturing, hospitality/food service, retail/e-commerce, environmental services, and IT/technology sectors. India is the most targeted country with at least 4 victims. The group's Tor leak site has shown intermittent availability (~50% uptime), consistent with an emerging operation.

Initial access vectors for Vexy intrusions have not been publicly documented as of this analysis. No specific CVEs, phishing campaigns, or vulnerability exploits have been attributed to the group. The Rust codebase aligns with a broader industry trend toward memory-safe, cross-compilable ransomware that resists reverse engineering (paralleling DeadLock, Kyber, and other Rust-based ransomware families). No public decryptor, full reverse-engineering report, YARA rules, Sigma rules, or Snort signatures have been published for Vexy as of September 6, 2026.

## MITRE ATT&CK

- T1485 Data Destruction
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1491 Defacement
- T1685 Disable or Modify Tools
- T1021 Remote Services
- T1090 Proxy
- T1048 Exfiltration Over Alternative Protocol
- T1059 Command and Scripting Interpreter
- T1588 Obtain Capabilities

## Sources

- [Vexy Ransomware — Mega Velocity victim disclosure (Ransomware.live)](https://www.ransomware.live/id/TWVnYSBWZWxvY2l0eUBWZXh5IFJhbnNvbXdhcmU=)
- [Ransomware Group Vexy Ransomware Hits Mega Velocity (HookPhish)](https://www.hookphish.com/blog/ransomware-group-vexy-ransomware-hits-mega-velocity/)
- [Vexy Ransomware Tracker (WatchGuard)](https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/vexy)
- [Vexy Ransomware (Breach House)](https://breach.house/groups/vexy-ransomware)
- [Vexy Ransomware Group Page (RansomLook)](https://www.ransomlook.io/group/vexy)
- [Vexy RaaS Affiliate Rules (RansomLook)](https://www.ransomlook.io/group/vexy/raas-rules)
- [Vexy Ransomware Emerges on Dark Web as New RaaS (UnderCode News)](https://undercodenews.com/vexy-ransomware-emerges-on-the-dark-web-as-a-new-raas-operation-targets-windows-and-linux-systems-video/)
- [Vexy Ransomware (Mallory.ai)](https://mallory.ai/actors/01a06838-9c7c-7366-8885-47ba858377f9)
- [Mega Velocity by Vexy Ransomware (HackerFeeds)](https://hackerfeeds.com/ransomware/mega-velocity-by-vexy-ransomware-4ha4)
- [ThreatCluster Ransomware Leak-Site Victims Dataset (HuggingFace)](https://huggingface.co/datasets/threatcluster/ransomware-leak-site-victims)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2363