Threat reportRansomwareTL-2026-3812
Vexy Ransomware Claims Data-Core Systems (dcsdev.org) Victim - 12 GB Exfiltrated
Vexy Ransomware Claims Data-Core Systems (dcsdev.org) Victim (TL-2026-3812) is a high-severity ransomware operation, first published 2026-10-17. It is attributed to Vexy Ransomware with medium confidence, affects Data-Core Systems Organization (dcsdev.org) - IT consulting and, maps to 11 MITRE ATT&CK techniques (T1021.001, T1047, T1059.003), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 11MITRE ATT&CK
- Actors
- 1Vexy Ransomware
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-3812
- Threat ID
- TL-2026-3812
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Vexy Ransomware
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- technology, it-services, retail, manufacturing
- Target regions
- india, brazil, united states of america, Latin America
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in Vexy Ransomware Claims Data-Core Systems (dcsdev.org) Victim
Malware and tooling: Vexy Ransomware, 7-Zip (7z), PSEXEC, WinRAR / rar
How Vexy Ransomware Claims Data-Core Systems (dcsdev.org) Victim works
Ransomware.live lists Data-Core Systems (dcsdev.org), an IT consulting and technology services firm, as a victim of the Vexy ransomware group, with 12 GB reportedly exfiltrated and discovery on 2026-10-16. The entry is flagged as a duplicate: the same domain was previously listed against the Flocker group in 2025.
On 2026-10-16 (16:55 UTC) Ransomware.live indexed a new leak-site claim by the Vexy ransomware group against Data-Core Systems (dcsdev.org), an IT consulting and technology services firm described in the listing as founded in 1988 and specializing in digital transformation and SAP implementation. The listing reports 12 GB of data exfiltrated and an estimated attack date of 2026-10-16. The victim country is not stated in the 2026 entry, no ransom amount is disclosed, and the tracker only indexes publicly visible leak-site information; it does not access or verify the stolen data. The claim is therefore an unverified extortion claim by the threat actor, and no technical artifacts specific to this intrusion (initial access vector, malware samples, hashes, C2) have been published.
The entry is flagged by Ransomware.live as a duplicate. A separate Ransomware.live entry for dcsdev.org (Data-Core Systems Inc.) attributes a listing to the Flocker group, discovered 2025-06-01 with an estimated attack date of 2025-05-25, country United States. That earlier entry describes the organization as 'The Automation Company' established in 2016, which differs from the 1988 founding date and the IT-consulting description in the Vexy entry; the two listings may describe different organizations sharing a domain label, or inconsistent self-descriptions, and this has not been resolved from the sources. The 2026 listing's exposure report notes 1 compromised password (0 critical) and 0 cookies; DNS shows GoDaddy/Secureserver hosting and no cloud/SaaS services were detected.
Vexy is an emerging ransomware operation first observed in mid-2026. Ransomware.live tracks 22 victims between an estimated first attack on 2026-07-06 and the Data-Core listing on 2026-10-16, with 799.6 GB of data exfiltrated across all victims, a single leak site on Tor, and two Bitcoin wallets used for ransom collection. Primary sectors are Technology (6 victims), Retail and E-Commerce (5) and Manufacturing (3); geographic focus is India (6), Brazil (3) and the United States (2), plus others. Ransomware.live correlates infostealer data with 68.2% of Vexy victims, and SOCRadar reports that operators obtain credentials from underground marketplaces, often harvested by infostealers, for initial access. The group operates a double-extortion model under an assessed closed or semi-private RaaS structure. Ransomware.live notes attack velocity declined about 75% versus the prior month.
A Security Arsenal analysis (2026-09-05) of the group's early victims offers an assessed, not confirmed, playbook: edge VPN/RMM exploitation, Windows privilege escalation, lateral movement over RDP/WMI, data staging and exfiltration, then staged encryption with volume shadow copy deletion, with a 5-14 day dwell time. Candidate entry vectors named there (CVE-2026-50751 in Check Point Security Gateway IKEv1, CVE-2024-1708 ScreenConnect, CVE-2025-60710, CVE-2023-21529 Exchange, CVE-2026-48027 Nx Console) are analyst hypotheses and are NOT linked to Data-Core Systems; they are not listed in this record's CVE list. Pre-encryption behaviors cited there include vssadmin delete shadows, wmic and diskshadow shadow copy operations, bcdedit recoveryenabled no, archiving with 7z/WinRAR/rar, PsExec/PsExesvc execution, WmiPrvSE spawning cmd.exe/powershell.exe, and new service installations (Event ID 7045). Defenders in technology and IT-services sectors should treat these as hunting leads for the group generally, not as confirmed activity at this victim.
MITRE ATT&CK techniques used in TL-2026-3812
Lateral Movement
T1021.001 Remote Desktop Protocol
Execution
T1047 Windows Management Instrumentation; T1059.003 Windows Command Shell; T1569.002 Service Execution
Collection
T1074.001 Local Data Staging; T1560.001 Archive via Utility
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Impact
T1490 Inhibit System Recovery; T1657 Financial Theft
Persistence
Affected products and versions in Vexy Ransomware Claims Data-Core Systems (dcsdev.org) Victim
- Data-Core Systems — Organization (dcsdev.org) - IT consulting and technology services
Remediation for Vexy Ransomware Claims Data-Core Systems (dcsdev.org) Victim
Immediate actions
- Data-Core Systems and its clients/partners: verify the claim, review access logs and rotate credentials for accounts tied to the exposed password noted in the exposure report
- Hunt for volume shadow copy deletion (vssadmin delete shadows, wmic shadowcopy, diskshadow) and bcdedit recoveryenabled no
- Hunt for PsExec/PsExesvc execution, WmiPrvSE spawning cmd.exe or powershell.exe, and new service installs (Event ID 7045)
- Check infostealer and credential-marketplace exposure for corporate domains and force resets where found
Workarounds
- Restrict RDP and administrative share access to jump hosts and segment SAP and ERP environments
Longer-term hardening
- Enforce MFA on VPN, RDP, RMM and email access
- Patch and monitor internet-facing edge devices and remote-management tools
- Maintain offline, immutable backups and test restores
- Alert on bulk archiving (7z, WinRAR, rar) and large outbound transfers from servers
Timeline of Vexy Ransomware Claims Data-Core Systems (dcsdev.org) Victim
- Estimated attack date of an earlier Ransomware.live listing for dcsdev.org (Data-Core Systems Inc.) attributed to the Flocker group, country United States
- Ransomware.live discovers and lists the dcsdev.org / Flocker entry (04:48 UTC)
- Estimated attack date of the first Vexy victim tracked by Ransomware.live
- Vexy's first victim (Engefitas, Brazil) is discovered on its leak site; five victims are listed within 72 hours
- Security Arsenal publishes an assessed playbook for Vexy: edge/RMM exploitation, RDP/WMI lateral movement, VSS deletion, double extortion
- Vexy claims French technology firm Groupe Proxitel on its dark web leak site
- Ransomware.live discovers the Vexy listing for Data-Core Systems (dcsdev.org) at 16:55 UTC: 12 GB exfiltrated, estimated attack date 2026-10-16, flagged duplicate
- Ransomware.live last verifies the Vexy leak site as online; group tracked at 22 victims and 799.6 GB exfiltrated overall
Sources cited for Vexy Ransomware Claims Data-Core Systems (dcsdev.org) Victim
- Ransomware.live - Data-Core Systems / Vexy Ransomware victim entry
- Ransomware.live - dcsdev.org / Flocker prior victim entry
- Ransomware.live - Vexy Ransomware group profile
- Security Arsenal - Vexy Ransomware Gang: 5 New Victims in 4 Days, India and LATAM Campaign, Sector Analysis and Detection Rules
- SOCRadar - Groupe Proxitel Data Breach (Vexy Ransomware)
- SOCRadar Ransomware Intelligence - Vexy Ransomware group
- DEXPOSE - Vexy Ransomware Strikes French Tech Firm Groupe Proxitel
Detection coverage for TL-2026-3812
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3812 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.