Vexy Ransomware Claims Quy Nhon University (Vietnam) — New Group, 50GB Exfiltrated

Key facts for Vexy Ransomware Quy Nhon

Detection coverage for Vexy Ransomware Quy Nhon

As of 2026-09-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2598 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Geo-Improbable Multi-IP Auth Burst Against Cloud Identity — Infostealer-Sourced Credential Stuffing (SPL)

Detects a burst of authentication attempts/successes for a single account across multiple source IPs and countries in a short window against a cloud identity provider (Azure AD/Entra ID, Google Workspace). Vexy Ransomware's tracked victim base is 66.7% correlated with domain-level infostealer log exposure, and QNU-specific third-party telemetry reports 12,269 exposed passwords and 93 exposed session cookies tied to the institution — this pattern flags automated credential-stuffing/password-spray using that harvested material as an initial-access precursor.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1078, T1589, T1591, T1555
• Data sources: azure_ad_signinlogs, google_workspace_login_audit, vpn_sso_gateway_logs
• Severity: high
• Confidence: medium

Splunk SPL

index=azuread sourcetype="azure:aad:signin" OR sourcetype="google:gsuite:login"
| eval app=coalesce(appDisplayName, application)
| eval src_ip=coalesce(ipAddress, ip_address)
| eval acct=coalesce(userPrincipalName, "actor.email")
| eval country=coalesce(location.countryOrRegion, country)
| bin _time span=15m
| stats count as attempts, dc(src_ip) as distinct_ips, dc(country) as distinct_countries, values(src_ip) as ip_list, values(country) as country_list by acct, _time, app
| where distinct_ips >= 3 AND distinct_countries >= 2 AND attempts >= 5
| eval risk="high"
| table _time, acct, app, attempts, distinct_ips, distinct_countries, ip_list, country_list, risk

Microsoft KQL

let lookback = 24h;
SigninLogs
| where TimeGenerated > ago(lookback)
| extend Country = tostring(LocationDetails.countryOrRegion)
| summarize Attempts = count(), DistinctIPs = dcount(IPAddress), DistinctCountries = dcount(Country), Countries = make_set(Country), IPs = make_set(IPAddress) by UserPrincipalName, AppDisplayName, bin(TimeGenerated, 15m)
| where DistinctIPs >= 3 and DistinctCountries >= 2 and Attempts >= 5
| project TimeGenerated, UserPrincipalName, AppDisplayName, Attempts, DistinctIPs, DistinctCountries, Countries, IPs

Sigma

title: Geo-Improbable Multi-IP Authentication Burst Against Cloud Identity (Credential-Stuffing / Infostealer-Sourced Login)
id: 7c1e5a3a-9c2f-4b6a-8e2d-1a2b3c4d5e6f
status: experimental
description: Detects a burst of authentication attempts/successes for a single account from multiple IP addresses across multiple countries within a short window, consistent with automated credential-stuffing or password-spray using credentials harvested by infostealer malware and traded/exposed via dark-web markets, as documented for Vexy Ransomware's tracked victim base (66.7% infostealer-correlated).
references:
  - https://attack.mitre.org/techniques/T1078/
  - https://attack.mitre.org/techniques/T1589/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-21
tags:
  - attack.initial-access
  - attack.t1078
  - attack.reconnaissance
  - attack.t1589
  - attack.t1591
  - attack.credential-access
  - attack.t1555
logsource:
  category: authentication
  product: azure
  service: signinlogs
detection:
  selection:
    ResultType|exists: true
  timeframe: 15m
  condition: selection | count(IPAddress) by UserPrincipalName >= 3
falsepositives:
  - Legitimate travel or VPN/proxy rotation generating multiple source IPs for one user
  - Bulk password-reset event causing simultaneous logins from many devices/locations
level: high

Known false positives:

• Legitimate travel or ISP/VPN IP rotation producing multiple source IPs for one legitimate user
• Institution-wide forced password reset causing near-simultaneous logins from many devices at once

Tuning notes: Baseline known staff/student ASNs and campus VPN egress ranges to suppress routine multi-device logins; exclude accounts flagged in an active, IT-approved travel or password-reset window; tighten distinct_countries threshold to >=3 in low-mobility user populations (e.g., registrar/finance staff) to cut noise.

• 🔒 Geo-Improbable Multi-IP Auth Burst Against Cloud Identity — Infostealer-Sourced Credential Stuffing (KQL) · unlock with TL Creds
• 🔒 Mass Repository Access & Bulk File Export Following Session-Token Reuse (KQL) · unlock with TL Creds
• 🔒 Tor Leak-Site Contact & Bulk Outbound Transfer to Public Cloud Storage (KQL) · unlock with TL Creds
• 🔒 Geo-Improbable Multi-IP Auth Burst Against Cloud Identity — Infostealer-Sourced Credential Stuffing (Sigma) · unlock with TL Creds
• 🔒 Mass Repository Access & Bulk File Export Following Session-Token Reuse (Sigma) · unlock with TL Creds
• 🔒 Tor Leak-Site Contact & Bulk Outbound Transfer to Public Cloud Storage (Sigma) · unlock with TL Creds
• 🔒 Mass Repository Access & Bulk File Export Following Session-Token Reuse (SPL) · unlock with TL Creds
• 🔒 Tor Leak-Site Contact & Bulk Outbound Transfer to Public Cloud Storage (SPL) · unlock with TL Creds

Indicators of compromise for Vexy Ransomware Quy Nhon

As of 2026-09-21, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-2598.

Sample indicators (3 of 19)

• Domain: qnu[.]edu[.]vn
• URL: hxxp://vexytsr3chimdz6siwaqi2lvxxwfkxvffkpwyanr2llequ2hkm56jvqd[.]onion
• Domain: portal-qnu[.]azurewebsites[.]net

Defanged, TLP:CLEAR. Full set of 19 indicators: unlock with TL Creds.

How Vexy Ransomware Quy Nhon works

The claim is publicly unverified by QNU, a regulator, or any independent security firm, and coincides with separately-sourced dark-web/attack-surface telemetry showing large-scale pre-existing credential exposure tied to the university.

On 2026-09-19 at 07:54 UTC, the leak-site tracker ransomware.live listed Quy Nhon University (qnu.edu.vn), a public, multidisciplinary Vietnamese university established in 1977 with a long-standing tradition in teacher education, as a victim of "Vexy Ransomware," a group the tracker explicitly labels a new/unverified actor whose claims "should be treated with caution until independently verified." The listing records an estimated attack date of 2026-09-18 and a claim of 50GB of exfiltrated data, alongside a direct ultimatum attributed to the group: "The full dump will be made available unless representatives from Quy Nhon University negotiate with us promptly." No regulator, breach-notification clearinghouse, or independent cybersecurity firm has confirmed that data left QNU's systems, and QNU itself has not publicly acknowledged contact with the group, data theft, or a security incident. Coverage from malware.news, DeXpose, GalaxyWarden, and HookPhish uniformly frames the listing as an extortion-stage assertion rather than confirmed proof of compromise; GalaxyWarden explicitly cautions that groups often "list organisations quickly to create urgency even when the claim is recycled from an older compromise, exaggerated, or entirely fabricated."

Vexy Ransomware itself is an emerging, financially motivated data-extortion operation. Ransomware.live's group profile dates its first tracked attack to 2026-09-02 (victim Engefitas, a Brazilian manufacturer) with discovery on 2026-09-03, and WatchGuard's independent tracker corroborates this earliest-activity window. WatchGuard classifies Vexy as a "data broker" style ransomware operation employing both direct extortion (data theft without confirmed encryption) and double extortion (data theft plus an encryption/leak threat). The group runs a Tor-hosted leak/negotiation site at vexytsr3chimdz6siwaqi2lvxxwfkxvffkpwyanr2llequ2hkm56jvqd[.]onion (Apache 2.4.68 on Debian, ~91.9% 30-day uptime as of 2026-09-21, last crawled 2026-09-21 05:36:53 UTC), lists two Bitcoin wallet addresses for ransom payment, and provides a Tox-protocol messenger identifier for direct victim negotiation — consistent with the peer-to-peer encrypted chat channels favored by other extortion crews to avoid centralized takedown.

As of 2026-09-19 to 2026-09-21, ransomware.live's group profile lists 15 confirmed Vexy victims across 10 countries, totaling 578.6GB of cumulative claimed exfiltration and an average attack-to-discovery delay of roughly one day: India (5 victims — the group's heaviest concentration, including i2k2 Networks, United Group, Sancity, Palsana Enviro/PEPL, and Annapurna Fashion), Brazil (2 — Engefitas and Logar Network Solutions), and one victim each in Vietnam (Quy Nhon University), Italy (STP Fashion Lab), Japan (Hashimoto Jimuki), the UK (Strad Solutions), Argentina (LIBRERIA SANTA FE), Mexico (Mega Velocity), the US (Sancity Soft Touch), and Ecuador (McDonald's Ecuador, a recognizable multinational franchise illustrating the group's largely indiscriminate targeting). By sector, Technology (4 victims), Retail & E-Commerce (3), and Manufacturing (3) lead, with Education (QNU) representing the group's first and only publicly reported higher-education victim to date — an outlier against its commodity commercial/industrial targeting pattern. Ransomware.live's operational metrics additionally report that 66.7% of Vexy's tracked victims are independently correlated with domain-level infostealer log exposure, indicating the group's targeting or claims lean heavily on credential material harvested by commodity infostealer malware rather than confirmed bespoke intrusion. No malware sample, encryption-extension identifier, ransom-note text, or confirmed initial-access technique for the group has surfaced in public reporting; every technical/incident-specific source consulted (malware.news, DeXpose, GalaxyWarden, HookPhish) explicitly states it contains no TTP, IOC, or attack-vector detail for the QNU incident specifically.

Separately from the Vexy claim itself, the ransomware.live listing surfaces third-party dark-web and attack-surface exposure data for QNU attributed to the monitoring vendor ParanoidLab: 32 compromised employees, 1,772 compromised users, 151 third-party employee credentials, 114 external attack-surface exposures, 12,269 exposed passwords (292 flagged critical), and 93 exposed cookies (12 flagged critical), alongside infrastructure fingerprinting showing QNU uses Google Workspace for email (primary MX records) and Microsoft Azure (portal-qnu.azurewebsites.net) for a web portal, with no traditional hosting provider identified in DNS records otherwise. This telemetry documents that credential and session material tied to QNU has circulated via infostealer logs/dark-web sources independent of any confirmed Vexy intrusion — consistent with the group's broader 66.7% infostealer-correlation pattern — and raises the plausibility of credential- or cookie-based access as a contributing risk factor, but does not by itself confirm Vexy's initial-access vector, which remains undisclosed in every source reviewed.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts

Command and Control

T1090 Proxy

Collection

T1213 Data from Information Repositories

Credential Access

T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1583 Acquire Infrastructure

Reconnaissance

T1589 Gather Victim Identity Information; T1591 Gather Victim Org Information

Impact

T1657 Financial Theft

Remediation for Vexy Ransomware Quy Nhon

Immediate actions

• Treat the claim as unverified but actionable: initiate a compromise assessment of QNU's Google Workspace tenant and the Azure-hosted portal-qnu.azurewebsites.net portal
• Force credential resets across staff, student, and third-party accounts given the scale of independently-reported password/cookie exposure (12,269 passwords, 93 cookies) tied to the domain
• Enable/verify multi-factor authentication on all Google Workspace and Azure-fronted accounts, and invalidate active web sessions given the 93 exposed session cookies
• Engage dark-web monitoring to watch for any data actually posted to Vexy's Tor leak site before/after the negotiation deadline

Longer-term hardening

• Stand up continuous dark-web and infostealer-log monitoring for institutional credentials, given the pre-existing large-scale exposure identified independent of this claim and the group's documented 66.7% infostealer-correlation rate across victims
• Deploy EDR with behavioral detection across endpoints and conduct regular phishing-awareness training to reduce infostealer infection risk
• Maintain offline, immutable backups and a tested incident-response/negotiation-refusal playbook for ransomware/extortion events
• Engage a qualified incident-response firm before any contact or negotiation with the group

Affected and fixed versions

• Quy Nhon University — Google Workspace email environment
• Quy Nhon University — Azure-hosted web portal (portal-qnu.azurewebsites.net)

Timeline of Vexy Ransomware Quy Nhon

• 2026-09-02 locked-ioc-11's earliest tracked attack date — victim locked-ioc-18 (Brazil, manufacturing sector) — per ransomware.live's group profile.
• 2026-09-03 locked-ioc-11 first publicly tracked/discovered as a new, unverified ransomware/data-extortion group; locked-ioc-18 (Brazil) and locked-ioc-8 (Ecuador, hospitality) both listed as early victims.
• 2026-09-04 locked-ioc-11 lists three India/US victims the same day: Palsana Enviro (PEPL, manufacturing), Annapurna Fashion (retail/e-commerce), and Sancity Soft Touch (US, technology).
• 2026-09-05 locked-ioc-11 claims locked-ioc-15 (Mexico, transportation-sector software firm) as a victim.
• 2026-09-07 locked-ioc-11 lists locked-ioc-16 (India, 116GB claimed) and LIBRERIA SANTA FE (Argentina, retail) as victims; Sancity (India) is separately listed around the same period (discovered 2026-09-06).
• 2026-09-09 locked-ioc-11 lists Logar Network Solutions (Brazil, technology) as a victim.
• 2026-09-10 locked-ioc-11 lists locked-ioc-14 (India, technology) as a victim.
• 2026-09-12 locked-ioc-11 lists locked-ioc-12 (UK, technology) as a victim, claiming 46.52GB of exfiltrated data.
• 2026-09-15 locked-ioc-11 lists Hashimoto Jimuki (Japan, manufacturing) as a victim — the group's most recent listing prior to the locked-ioc-7 claim, showing a near-continuous weekly cadence.
• 2026-09-17 locked-ioc-11 lists locked-ioc-13 (Italy, retail/e-commerce) as a victim, claiming 79.94GB of exfiltrated data.
• 2026-09-18 Estimated attack/compromise date for locked-ioc-7 per the ransomware.live listing.
• 2026-09-19 malware.news, DeXpose, GalaxyWarden, and HookPhish publish alerts on the QNU listing, each explicitly noting the claim is unverified and QNU has not confirmed contact, theft, or breach; GalaxyWarden cautions the rapid listing timeline is consistent with pressure tactics rather than a verified, investigated compromise.
• 2026-09-19 Vexy issues a public ultimatum: "The full dump will be made available unless representatives from locked-ioc-7 negotiate with us promptly."
• 2026-09-19 locked-ioc-11 publicly lists locked-ioc-7 (locked-ioc-17) on its Tor leak site at 07:54 UTC, claiming 50GB of exfiltrated institutional data — the group's first and only reported higher-education victim to date.
• 2026-09-21 Vexy's Tor leak site (Apache 2.4.68/Debian) confirmed online with ~91.9% 30-day uptime, last crawled 05:36:53 UTC; group profile shows 15 confirmed victims across 10 countries, 578.6GB of cumulative claimed exfiltration, and a 66.7% infostealer-correlation rate across tracked victims.

Sources cited for Vexy Ransomware Quy Nhon

• Vexy Ransomware Tracker Profile — WatchGuard Technologies watchguard.com · Vendor report · 2026-09-20
• Vexy Ransomware Ransomware Group Profile — SOCRadar socradar.io · Research · 2026-09-21
• Quy Nhon University Listed by Vexy Ransomware Ransomware Group galaxywarden.com · Blog · 2026-09-19
• Quy Nhon University Listed by Vexy Ransomware Group galaxywarden.com · Blog · 2026-09-19
• Vexy Ransomware Targets Quy Nhon University in Vietnam dexpose.io · Blog · 2026-09-19
• Ransomware Group Vexy Ransomware Hits: Mega Velocity hookphish.com · Blog · 2026-09-05
• Vexy Ransomware Targets Quy Nhon University in Vietnam malware.news · News · 2026-09-19
• Ransomware.live victim listing: Quy Nhon University — Vexy Ransomware ransomware.live · Leak-site-tracker · 2026-09-19
• Ransomware.live group profile: Vexy Ransomware ransomware.live · Leak-site-tracker · 2026-09-21

More in ransomware

• Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing
• BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments
• HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files
• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated
• Queens Public Library Ransomware Attack Disrupts Wi-Fi, On-Site Computers and Digital Services

More from Vexy Ransomware

• Vexy Ransomware claims JHAMF Group (IT services) - 110 GB exfiltrated
• Vexy Ransomware claims System Soft (Bulgaria) - 65 GB exfiltrated
• Vexy Ransomware claims polisee Inc (AI policy intelligence platform) as victim
• Vexy Ransomware Claims Data-Core Systems (dcsdev.org) Victim - 12 GB Exfiltrated
• Vexy Ransomware claims Enchanted Fine Jewellery (India, Retail & E-Commerce) - 34.88 GB exfiltrated
• Vexy Ransomware claims Guarufilme (Brazil) - 60 GB exfiltrated

Previous and next in ransomware

• Ransomware Attack Disrupts IT Systems and Services in Ellis County, Kansas Previous report
• Ryuk Ransomware Initial Access Operator Karen Vardanyan ("Maneeken") Sentenced to 24 Months in U.S. Federal Prison Next report