Threat reportRansomwareTL-2026-3678
Vexy Ransomware claims Enchanted Fine Jewellery (India, Retail & E-Commerce) - 34.88 GB exfiltrated
Vexy Ransomware claims Enchanted Fine Jewellery (India (TL-2026-3678), also tracked as Vexy Ransomware Enchanted Fine Jewellery leak, is a medium-severity ransomware operation, first published 2026-10-15. It is attributed to Vexy Ransomware with medium confidence, affects Enchanted Fine Jewellery Corporate IT environment and e-commerce, maps to 7 MITRE ATT&CK techniques (T1021, T1059, T1078), and is covered by 9 detection rules and 11 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 7MITRE ATT&CK
- Actors
- 1Vexy Ransomware
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-3678
- Threat ID
- TL-2026-3678
- Also known as
- Vexy Ransomware Enchanted Fine Jewellery leak
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Vexy Ransomware
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- retail, ecommerce, technology, manufacturing
- Target regions
- india, brazil, Latin America
- Detection rules
- 9
- Indicators of compromise
- 11
Malware and tooling in Vexy Ransomware claims Enchanted Fine Jewellery (India
Malware and tooling: Rust cross-platform encryptor, Vexy Ransomware
How Vexy Ransomware claims Enchanted Fine Jewellery (India works
Ransomware.live lists Enchanted Fine Jewellery (enchantedfinejewellery.in), an Indian retail and e-commerce business, as a victim on the Vexy Ransomware leak site, discovered 2026-10-15 11:22 UTC, with 34.88 GB listed as exfiltrated. The listing indexes operator-posted claims; the breach has not been independently confirmed by the victim.
On 2026-10-15 the ransomware tracker Ransomware.live indexed a new Vexy Ransomware leak-site post naming Enchanted Fine Jewellery (domain enchantedfinejewellery.in, India, sector Retail & E-Commerce) and listing 34.88 GB of data as exfiltrated. The listing carries no narrative, ransom demand, proof pack, onion link or deadline. The estimated attack date is the same day as discovery (2026-10-15). Tracker DNS enrichment shows MX records at mail.enchantedfinejewellery.in and enchantedfinejewellery.in, no TXT records, and a GoDaddy abuse WHOIS contact. A ParanoidLab exposure query run 2026-10-15 reported zero exposed passwords and zero exposed cookies, so there is no credential-exposure lead for initial access. No cloud/SaaS compromise was reported. All details are operator claims aggregated by a single tracker and are unverified.
Vexy Ransomware is a newly observed extortion operation. Trackers differ on first-seen dates: noransom.net cites the earliest claimed victim on 2026-09-02, Breachsense and others give 2026-09-04 as the first posting, and Ransomware.live lists an estimated first attack of 2026-07-06 with leak-site discovery on 2026-09-03. Ransomware.live (as of 2026-10-15) counts 21 victims and 787.6 GB claimed exfiltrated across 13 countries; India is the most frequent country (6 victims on Ransomware.live, 8 on Breachsense), followed by Brazil, with Retail & E-Commerce, Technology and Manufacturing among the top sectors. Victim counts differ between trackers (20-21). The group operates a Tor leak site titled 'Vexy Ransomware | Blog' running Apache 2.4.68 (Debian), and Ransomware.live lists two Bitcoin wallets associated with the group.
Technical visibility is very limited. As of 2026-09-11 noransom.net reported no vendor or CERT sample analysis, no confirmed encrypted-file extension, ransom note name or decryptor, and described the model as steal-first, extort-second with full-publication threats; a Tox messenger ID is described as the primary contact channel. A 'Rust cross-platform encryptor' is mentioned only in unverified secondary sources, and whether encryption actually occurs is unconfirmed. Initial access vectors listed by noransom.net (exposed remote access without MFA, unpatched edge appliances, managed-service pivots, infostealer-sourced credentials) are derived from victim profiles, not observed for this incident. ATT&CK techniques mapped here come from tracker-reported group techniques and the claimed extortion behavior, and should be treated as low-confidence. No CVE is associated with this listing. Severity is set to MEDIUM pending corroboration.
MITRE ATT&CK techniques used in TL-2026-3678
Lateral Movement
Execution
T1059 Command and Scripting Interpreter
Persistence
T1078 Valid Accounts; T1547 Boot or Logon Autostart Execution
Impact
T1490 Inhibit System Recovery; T1657 Financial Theft
defense-impairment
Affected products and versions in Vexy Ransomware claims Enchanted Fine Jewellery (India
- Enchanted Fine Jewellery — Corporate IT environment and e-commerce operations (enchantedfinejewellery.in)
Remediation for Vexy Ransomware claims Enchanted Fine Jewellery (India
Patches
- No CVE is associated with this listing; keep internet-facing VPN, remote access and edge appliances patched to current vendor releases
Immediate actions
- Treat the claim as unverified: Enchanted Fine Jewellery should check for unauthorized access, data staging and large outbound transfers around 2026-10-15 and earlier
- Rotate credentials for VPN, RDP, e-commerce admin, email and cloud accounts and enforce MFA on all remote access
- Review mail.enchantedfinejewellery.in mail logs and e-commerce platform admin audit logs for anomalous access
- Block the Vexy leak-site onion service from corporate egress and monitor for the victim domain on the leak site
Workarounds
- Restrict internet exposure of RDP and VPN endpoints and require MFA
- Limit administrative access to retail, ERP and e-commerce back-office systems to named hosts
Longer-term hardening
- Maintain offline, immutable, tested backups and protect backup consoles with separate credentials
- Deploy EDR with ransomware behavioral detection and alert on shadow copy deletion and recovery inhibition
- Monitor outbound data volume and restrict bulk egress to uncommon destinations
- Subscribe to ransomware leak-site monitoring for owned domains and supplier domains
Timeline of Vexy Ransomware claims Enchanted Fine Jewellery (India
- Ransomware.live lists 2026-07-06 as the estimated attack date of the earliest Vexy victim
- noransom.net reports the earliest claimed Vexy victim on 2026-09-02
- Vexy Ransomware leak site first indexed by Ransomware.live
- Breachsense records the first Vexy victim posting on its leak site
- noransom.net notes no vendor or CERT sample analysis, IOC set, extension, ransom note or decryptor is public; 10-12 victims counted
- Breachsense lists 2026-10-14 as the most recent attack before the Enchanted Fine Jewellery listing
- ParanoidLab exposure query reports zero passwords and zero cookies for the victim domain
- Enchanted Fine Jewellery (enchantedfinejewellery.in, India, Retail & E-Commerce) listed on the Vexy leak site with 34.88 GB claimed exfiltrated; discovered 11:22 UTC
Sources cited for Vexy Ransomware claims Enchanted Fine Jewellery (India
- Ransomware.live - Enchanted Fine Jewellery (Vexy Ransomware)
- Ransomware.live - Vexy Ransomware group profile
- Breachsense - Vexy ransomware group
- noransom.net - Vexy (New Vexy) Ransomware Response & Recovery
- SOCRadar - Vexy Ransomware group profile
- ismalicious - Vexy Ransomware IOCs & TTPs
- SOCRadar - Groupe Proxitel Data Breach (Vexy Ransomware)
- Dexpose - Vexy Ransomware Targets Palsana Enviro in India
Detection coverage for TL-2026-3678
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3678 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.