Threat reportRansomwareTL-2026-3409
Vexy Ransomware claims Guarufilme (Brazil) - 60 GB exfiltrated
Vexy Ransomware claims Guarufilme (Brazil) (TL-2026-3409) is a high-severity ransomware operation, first published 2026-10-13. It is attributed to Vexy Ransomware with medium confidence, affects Guarufilme Corporate IT environment (www.guarufilme.com.br, maps to 12 MITRE ATT&CK techniques (T1021.001, T1047, T1059), and is covered by 9 detection rules and 12 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 12MITRE ATT&CK
- Actors
- 1Vexy Ransomware
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-3409
- Threat ID
- TL-2026-3409
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Vexy Ransomware
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, technology, retail, telecoms, packaging
- Target regions
- 005 - South America, brazil, india, Latin America
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in Vexy Ransomware claims Guarufilme (Brazil)
Malware and tooling: Vexy Ransomware, 7-Zip, PSEXEC, WinRAR
How Vexy Ransomware claims Guarufilme (Brazil) works
The Vexy Ransomware group listed Guarufilme, a Brazilian PVC and polyethylene film packaging manufacturer (www.guarufilme.com.br), as a victim on 2026-10-13, claiming 60 GB of exfiltrated data. Vexy is an emerging double-extortion operation first observed in mid-2026 that has targeted mainly India and Latin America.
ransomware.live recorded Guarufilme (www.guarufilme.com.br), a Brazilian manufacturer of PVC and polyethylene films for domestic and industrial packaging that has operated since 2006, as a victim of the Vexy Ransomware group on 2026-10-13. The listing states that 60 GB of data was exfiltrated. The listing gives no ransom amount, no data samples and no description of the intrusion. No CVE is associated with this incident.
The same listing carries exposure data on the victim: 137 exposed passwords (18 rated critical, attributed to ParanoidLab), one third-party employee credential (attributed to HudsonRock), and no exposed session cookies. The victim's mail server is mail.guarufilme.com.br. Its SPF record references 15.235.50.43, 54.39.169.139 and host74.hoteldaweb.com.br. These are victim-side DNS and hosting artifacts, not confirmed attacker infrastructure. A BeaconBeagle lookup for both IPs returned HTTP 404, so there is no known C2 correlation.
Vexy Ransomware is an emerging operation first observed in mid-2026. Per third-party trackers it runs a closed or semi-private RaaS model with double extortion, posting victims on a Tor leak portal and threatening publication unless the victim makes contact. Reported targeting is mainly technology, retail and e-commerce, and manufacturing organizations in India, Brazil, Ecuador, Argentina, Italy and Timor-Leste. Brazilian victims reported before Guarufilme include Engefitas (manufacturing, 2026-09-02) and Logar Network Solutions (managed IT services, claimed 2026-09-09).
Intrusion method for Guarufilme is unknown. Third-party aggregator profiles state that Vexy operators buy infostealer-harvested credentials from underground markets for initial access. The aggregator profiles also list tooling and post-compromise behaviors: PsExec, WMI and RDP lateral movement, shadow-copy deletion with vssadmin, diskshadow and bcdedit, termination of backup and database services, and staging and exfiltration with 7z or RAR before encryption. One vendor blog (SecurityArsenal) additionally lists CVE-2026-50751, CVE-2024-1708 and CVE-2025-60710 as initial-access and privilege-escalation vectors. Those CVEs are not corroborated by a primary source and are not asserted here. Treat all Vexy TTP detail as aggregator-reported, medium-to-low confidence, and not confirmed for this victim. The 60 GB volume is the group's own claim and has not been independently verified.
MITRE ATT&CK techniques used in TL-2026-3409
Lateral Movement
T1021.001 Remote Desktop Protocol; T1080 Taint Shared Content
Execution
T1047 Windows Management Instrumentation; T1059 Command and Scripting Interpreter
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1566 Phishing
Impact
T1489 Service Stop; T1490 Inhibit System Recovery; T1657 Financial Theft
Collection
defense-impairment
Affected products and versions in Vexy Ransomware claims Guarufilme (Brazil)
- Guarufilme — Corporate IT environment (www.guarufilme.com.br; mail.guarufilme.com.br)
Vulnerable versions: Unknown
Remediation for Vexy Ransomware claims Guarufilme (Brazil)
Patches
- No CVE is tied to this incident; keep internet-facing gateways and remote-access software patched
Immediate actions
- Force password resets and revoke sessions for all accounts present in the 137 exposed passwords, prioritizing the 18 rated critical and the third-party employee credential
- Enforce MFA on mail (mail.guarufilme.com.br), VPN, RDP and remote-management access
- Hunt for shadow-copy deletion (vssadmin, diskshadow, bcdedit), mass service stops, PsExec or WMI lateral movement, and 7z/RAR staging of large archives
- Monitor outbound transfers for anomalous volumes (tens of GB) to unfamiliar destinations
Workarounds
- Block inbound RDP from the internet and require VPN with MFA
- Limit PsExec and WMI remote execution to administrative jump hosts
Longer-term hardening
- Monitor infostealer and credential-leak feeds for corporate domains and rotate exposed credentials promptly
- Maintain offline or immutable backups and test restoration
- Restrict internet-exposed RDP and remote-access services and segment the network
- Deploy EDR with ransomware behavioral detection and alert on mass file encryption
Timeline of Vexy Ransomware claims Guarufilme (Brazil)
- Vexy Ransomware lists Engefitas (Brazil, manufacturing), among its earliest tracked leak-site claims; its group profile places first observation in mid-2026
- Vexy lists Sancity Soft Touch, Annapurna Fashion and Palsana Enviro (India) the same day, after McDonald's Ecuador on 2026-09-03, per SecurityArsenal
- SecurityArsenal publishes a Vexy Ransomware intelligence summary describing a closed RaaS model, double extortion and reported TTPs
- Vexy lists Libreria Santa Fe (Argentina) and threatens to publish the full leak unless a company representative makes contact, per DeXpose
- Vexy claims Logar Network Solutions (Brazil, managed IT services) and threatens to publish the full leak unless the company makes contact
- Vexy claims i2k2 Networks (India, cloud and IT services) and threatens full publication unless the company initiates contact, per DeXpose
- Vexy lists STP Fashion Lab (Italy, fashion), extending its reported victimology to Europe, per DeXpose
- ransomware.live lists Guarufilme (Brazil, PVC/polyethylene film packaging) as a Vexy Ransomware victim, discovered 12:31 UTC, with 60 GB claimed exfiltrated and HudsonRock infostealer activity noted; 137 exposed passwords and 1 third-party employee credential are reported for the victim
Sources cited for Vexy Ransomware claims Guarufilme (Brazil)
- ransomware.live - Guarufilme / Vexy Ransomware victim listing
- SecurityArsenal - Vexy Ransomware gang: 5 new victims in 4 days (India and LATAM campaign, sector analysis, detection rules)
- DeXpose - Vexy Ransomware Targets Logar Network Solutions in Brazil
- SOCRadar - Groupe Proxitel Data Breach (Vexy Ransomware)
- SOCRadar - STP Fashion Lab Data Breach (Vexy Ransomware)
- SOCRadar Ransomware Intelligence - Vexy Ransomware group profile
Detection coverage for TL-2026-3409
As of 2026-10-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3409 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.