# Vexy Ransomware Claims Quy Nhon University (Vietnam) — New Group, 50GB Exfiltrated

> Vexy Ransomware, a data-extortion group first tracked in early September 2026, added Quy Nhon University (QNU), a public multidisciplinary university in Binh Dinh Province, Vietnam, to its Tor leak site on 2026-09-19, claiming 50GB of exfiltrated data and threatening to publish the "full dump" absent negotiation. The claim is publicly unverified by QNU, a regulator, or any independent security firm, and coincides with separately-sourced dark-web/attack-surface telemetry showing large-scale pre-existing credential exposure tied to the university.

- **Published:** 2026-09-21T00:00:00Z
- **Last reviewed:** 2026-09-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2598
- **ID:** TL-2026-2598
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Vexy Ransomware
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-09-19 at 07:54 UTC, the leak-site tracker ransomware.live listed Quy Nhon University (qnu.edu.vn), a public, multidisciplinary Vietnamese university established in 1977 with a long-standing tradition in teacher education, as a victim of "Vexy Ransomware," a group the tracker explicitly labels a new/unverified actor whose claims "should be treated with caution until independently verified." The listing records an estimated attack date of 2026-09-18 and a claim of 50GB of exfiltrated data, alongside a direct ultimatum attributed to the group: "The full dump will be made available unless representatives from Quy Nhon University negotiate with us promptly." No regulator, breach-notification clearinghouse, or independent cybersecurity firm has confirmed that data left QNU's systems, and QNU itself has not publicly acknowledged contact with the group, data theft, or a security incident. Coverage from malware.news, DeXpose, GalaxyWarden, and HookPhish uniformly frames the listing as an extortion-stage assertion rather than confirmed proof of compromise; GalaxyWarden explicitly cautions that groups often "list organisations quickly to create urgency even when the claim is recycled from an older compromise, exaggerated, or entirely fabricated."

Vexy Ransomware itself is an emerging, financially motivated data-extortion operation. Ransomware.live's group profile dates its first tracked attack to 2026-09-02 (victim Engefitas, a Brazilian manufacturer) with discovery on 2026-09-03, and WatchGuard's independent tracker corroborates this earliest-activity window. WatchGuard classifies Vexy as a "data broker" style ransomware operation employing both direct extortion (data theft without confirmed encryption) and double extortion (data theft plus an encryption/leak threat). The group runs a Tor-hosted leak/negotiation site at vexytsr3chimdz6siwaqi2lvxxwfkxvffkpwyanr2llequ2hkm56jvqd[.]onion (Apache 2.4.68 on Debian, ~91.9% 30-day uptime as of 2026-09-21, last crawled 2026-09-21 05:36:53 UTC), lists two Bitcoin wallet addresses for ransom payment, and provides a Tox-protocol messenger identifier for direct victim negotiation — consistent with the peer-to-peer encrypted chat channels favored by other extortion crews to avoid centralized takedown.

As of 2026-09-19 to 2026-09-21, ransomware.live's group profile lists 15 confirmed Vexy victims across 10 countries, totaling 578.6GB of cumulative claimed exfiltration and an average attack-to-discovery delay of roughly one day: India (5 victims — the group's heaviest concentration, including i2k2 Networks, United Group, Sancity, Palsana Enviro/PEPL, and Annapurna Fashion), Brazil (2 — Engefitas and Logar Network Solutions), and one victim each in Vietnam (Quy Nhon University), Italy (STP Fashion Lab), Japan (Hashimoto Jimuki), the UK (Strad Solutions), Argentina (LIBRERIA SANTA FE), Mexico (Mega Velocity), the US (Sancity Soft Touch), and Ecuador (McDonald's Ecuador, a recognizable multinational franchise illustrating the group's largely indiscriminate targeting). By sector, Technology (4 victims), Retail & E-Commerce (3), and Manufacturing (3) lead, with Education (QNU) representing the group's first and only publicly reported higher-education victim to date — an outlier against its commodity commercial/industrial targeting pattern. Ransomware.live's operational metrics additionally report that 66.7% of Vexy's tracked victims are independently correlated with domain-level infostealer log exposure, indicating the group's targeting or claims lean heavily on credential material harvested by commodity infostealer malware rather than confirmed bespoke intrusion. No malware sample, encryption-extension identifier, ransom-note text, or confirmed initial-access technique for the group has surfaced in public reporting; every technical/incident-specific source consulted (malware.news, DeXpose, GalaxyWarden, HookPhish) explicitly states it contains no TTP, IOC, or attack-vector detail for the QNU incident specifically.

Separately from the Vexy claim itself, the ransomware.live listing surfaces third-party dark-web and attack-surface exposure data for QNU attributed to the monitoring vendor ParanoidLab: 32 compromised employees, 1,772 compromised users, 151 third-party employee credentials, 114 external attack-surface exposures, 12,269 exposed passwords (292 flagged critical), and 93 exposed cookies (12 flagged critical), alongside infrastructure fingerprinting showing QNU uses Google Workspace for email (primary MX records) and Microsoft Azure (portal-qnu.azurewebsites.net) for a web portal, with no traditional hosting provider identified in DNS records otherwise. This telemetry documents that credential and session material tied to QNU has circulated via infostealer logs/dark-web sources independent of any confirmed Vexy intrusion — consistent with the group's broader 66.7% infostealer-correlation pattern — and raises the plausibility of credential- or cookie-based access as a contributing risk factor, but does not by itself confirm Vexy's initial-access vector, which remains undisclosed in every source reviewed.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1591 Gather Victim Org Information
- T1583 Acquire Infrastructure
- T1078 Valid Accounts
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1213 Data from Information Repositories
- T1567 Exfiltration Over Web Service
- T1090 Proxy
- T1657 Financial Theft

## Sources

- [Ransomware.live victim listing: Quy Nhon University — Vexy Ransomware](https://www.ransomware.live/id/UXV5IE5ob24gVW5pdmVyc2l0eUBWZXh5IFJhbnNvbXdhcmU=)
- [Ransomware.live group profile: Vexy Ransomware](https://www.ransomware.live/group/Vexy%20Ransomware)
- [Vexy Ransomware Tracker Profile — WatchGuard Technologies](https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/vexy)
- [Vexy Ransomware Targets Quy Nhon University in Vietnam](https://malware.news/t/vexy-ransomware-targets-quy-nhon-university-in-vietnam/125735)
- [Quy Nhon University Listed by Vexy Ransomware Ransomware Group](https://www.galaxywarden.com/blog/breach/quy-nhon-university-vexyransomware-2026-09)
- [Quy Nhon University Listed by Vexy Ransomware Group](https://www.galaxywarden.com/blog/breach/quy-nhon-university-vexy-2026-09)
- [Vexy Ransomware Targets Quy Nhon University in Vietnam](https://www.dexpose.io/vexy-ransomware-targets-quy-nhon-university-in-vietnam/)
- [Ransomware Group Vexy Ransomware Hits: Mega Velocity](https://www.hookphish.com/blog/ransomware-group-vexy-ransomware-hits-mega-velocity/)
- [Vexy Ransomware Ransomware Group Profile — SOCRadar](https://socradar.io/free-tools/ransomware-intelligence/groups/vexy-ransomware)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2598