# Vexy Ransomware claims Guarufilme (Brazil) - 60 GB exfiltrated

> The Vexy Ransomware group listed Guarufilme, a Brazilian PVC and polyethylene film packaging manufacturer (www.guarufilme.com.br), as a victim on 2026-10-13, claiming 60 GB of exfiltrated data. Vexy is an emerging double-extortion operation first observed in mid-2026 that has targeted mainly India and Latin America.

- **Published:** 2026-10-13T12:48:40Z
- **Last reviewed:** 2026-10-13T12:48:40Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3409
- **ID:** TL-2026-3409
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Vexy Ransomware
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ransomware.live recorded Guarufilme (www.guarufilme.com.br), a Brazilian manufacturer of PVC and polyethylene films for domestic and industrial packaging that has operated since 2006, as a victim of the Vexy Ransomware group on 2026-10-13. The listing states that 60 GB of data was exfiltrated. The listing gives no ransom amount, no data samples and no description of the intrusion. No CVE is associated with this incident.

The same listing carries exposure data on the victim: 137 exposed passwords (18 rated critical, attributed to ParanoidLab), one third-party employee credential (attributed to HudsonRock), and no exposed session cookies. The victim's mail server is mail.guarufilme.com.br. Its SPF record references 15.235.50.43, 54.39.169.139 and host74.hoteldaweb.com.br. These are victim-side DNS and hosting artifacts, not confirmed attacker infrastructure. A BeaconBeagle lookup for both IPs returned HTTP 404, so there is no known C2 correlation.

Vexy Ransomware is an emerging operation first observed in mid-2026. Per third-party trackers it runs a closed or semi-private RaaS model with double extortion, posting victims on a Tor leak portal and threatening publication unless the victim makes contact. Reported targeting is mainly technology, retail and e-commerce, and manufacturing organizations in India, Brazil, Ecuador, Argentina, Italy and Timor-Leste. Brazilian victims reported before Guarufilme include Engefitas (manufacturing, 2026-09-02) and Logar Network Solutions (managed IT services, claimed 2026-09-09).

Intrusion method for Guarufilme is unknown. Third-party aggregator profiles state that Vexy operators buy infostealer-harvested credentials from underground markets for initial access. The aggregator profiles also list tooling and post-compromise behaviors: PsExec, WMI and RDP lateral movement, shadow-copy deletion with vssadmin, diskshadow and bcdedit, termination of backup and database services, and staging and exfiltration with 7z or RAR before encryption. One vendor blog (SecurityArsenal) additionally lists CVE-2026-50751, CVE-2024-1708 and CVE-2025-60710 as initial-access and privilege-escalation vectors. Those CVEs are not corroborated by a primary source and are not asserted here. Treat all Vexy TTP detail as aggregator-reported, medium-to-low confidence, and not confirmed for this victim. The 60 GB volume is the group's own claim and has not been independently verified.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1133 External Remote Services
- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1047 Windows Management Instrumentation
- T1685 Disable or Modify Tools
- T1021.001 Remote Desktop Protocol
- T1080 Taint Shared Content
- T1560.001 Archive via Utility
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1657 Financial Theft

## Sources

- [ransomware.live - Guarufilme / Vexy Ransomware victim listing](https://www.ransomware.live/id/R3VhcnVmaWxtZUBWZXh5IFJhbnNvbXdhcmU=)
- [SecurityArsenal - Vexy Ransomware gang: 5 new victims in 4 days (India and LATAM campaign, sector analysis, detection rules)](https://securityarsenal.com/blog/vexy-ransomware-gang-5-new-victims-in-4-days-india-and-latam-campaign-sector-analysis-and-detection-rules)
- [DeXpose - Vexy Ransomware Targets Logar Network Solutions in Brazil](https://www.dexpose.io/vexy-ransomware-targets-logar-network-solutions-in-brazil/)
- [SOCRadar - Groupe Proxitel Data Breach (Vexy Ransomware)](https://socradar.io/blog/data-breach/groupe-proxitel-vexy-ransomware-2026/)
- [SOCRadar - STP Fashion Lab Data Breach (Vexy Ransomware)](https://socradar.io/blog/data-breach/stp-fashion-lab-vexy-ransomware-2026/)
- [SOCRadar Ransomware Intelligence - Vexy Ransomware group profile](https://socradar.io/free-tools/ransomware-intelligence/groups/vexy-ransomware)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3409