# Vexy Ransomware claims Enchanted Fine Jewellery (India, Retail & E-Commerce) - 34.88 GB exfiltrated

> Ransomware.live lists Enchanted Fine Jewellery (enchantedfinejewellery.in), an Indian retail and e-commerce business, as a victim on the Vexy Ransomware leak site, discovered 2026-10-15 11:22 UTC, with 34.88 GB listed as exfiltrated. The listing indexes operator-posted claims; the breach has not been independently confirmed by the victim.

- **Published:** 2026-10-15T23:44:21Z
- **Last reviewed:** 2026-10-15T23:44:21Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3678
- **ID:** TL-2026-3678
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Vexy Ransomware
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-15 the ransomware tracker Ransomware.live indexed a new Vexy Ransomware leak-site post naming Enchanted Fine Jewellery (domain enchantedfinejewellery.in, India, sector Retail & E-Commerce) and listing 34.88 GB of data as exfiltrated. The listing carries no narrative, ransom demand, proof pack, onion link or deadline. The estimated attack date is the same day as discovery (2026-10-15). Tracker DNS enrichment shows MX records at mail.enchantedfinejewellery.in and enchantedfinejewellery.in, no TXT records, and a GoDaddy abuse WHOIS contact. A ParanoidLab exposure query run 2026-10-15 reported zero exposed passwords and zero exposed cookies, so there is no credential-exposure lead for initial access. No cloud/SaaS compromise was reported. All details are operator claims aggregated by a single tracker and are unverified.

Vexy Ransomware is a newly observed extortion operation. Trackers differ on first-seen dates: noransom.net cites the earliest claimed victim on 2026-09-02, Breachsense and others give 2026-09-04 as the first posting, and Ransomware.live lists an estimated first attack of 2026-07-06 with leak-site discovery on 2026-09-03. Ransomware.live (as of 2026-10-15) counts 21 victims and 787.6 GB claimed exfiltrated across 13 countries; India is the most frequent country (6 victims on Ransomware.live, 8 on Breachsense), followed by Brazil, with Retail & E-Commerce, Technology and Manufacturing among the top sectors. Victim counts differ between trackers (20-21). The group operates a Tor leak site titled 'Vexy Ransomware | Blog' running Apache 2.4.68 (Debian), and Ransomware.live lists two Bitcoin wallets associated with the group.

Technical visibility is very limited. As of 2026-09-11 noransom.net reported no vendor or CERT sample analysis, no confirmed encrypted-file extension, ransom note name or decryptor, and described the model as steal-first, extort-second with full-publication threats; a Tox messenger ID is described as the primary contact channel. A 'Rust cross-platform encryptor' is mentioned only in unverified secondary sources, and whether encryption actually occurs is unconfirmed. Initial access vectors listed by noransom.net (exposed remote access without MFA, unpatched edge appliances, managed-service pivots, infostealer-sourced credentials) are derived from victim profiles, not observed for this incident. ATT&CK techniques mapped here come from tracker-reported group techniques and the claimed extortion behavior, and should be treated as low-confidence. No CVE is associated with this listing. Severity is set to MEDIUM pending corroboration.

## MITRE ATT&CK

- T1059 Command and Scripting Interpreter
- T1078 Valid Accounts
- T1547 Boot or Logon Autostart Execution
- T1685 Disable or Modify Tools
- T1021 Remote Services
- T1490 Inhibit System Recovery
- T1657 Financial Theft

## Sources

- [Ransomware.live - Enchanted Fine Jewellery (Vexy Ransomware)](https://www.ransomware.live/id/RW5jaGFudGVkIEZpbmUgSmV3ZWxsZXJ5QFZleHkgUmFuc29td2FyZQ==)
- [Ransomware.live - Vexy Ransomware group profile](https://www.ransomware.live/group/vexy)
- [Breachsense - Vexy ransomware group](https://www.breachsense.com/ransomware-groups/vexy/)
- [noransom.net - Vexy (New Vexy) Ransomware Response & Recovery](https://noransom.net/en/ransomware/new-vexy/)
- [SOCRadar - Vexy Ransomware group profile](https://socradar.io/free-tools/ransomware-intelligence/groups/vexy-ransomware)
- [ismalicious - Vexy Ransomware IOCs & TTPs](https://ismalicious.com/ransomware/group/vexy%20ransomware)
- [SOCRadar - Groupe Proxitel Data Breach (Vexy Ransomware)](https://socradar.io/blog/data-breach/groupe-proxitel-vexy-ransomware-2026/)
- [Dexpose - Vexy Ransomware Targets Palsana Enviro in India](https://www.dexpose.io/?p=43728)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3678