# Vexy Ransomware Claims Data-Core Systems (dcsdev.org) Victim - 12 GB Exfiltrated

> Ransomware.live lists Data-Core Systems (dcsdev.org), an IT consulting and technology services firm, as a victim of the Vexy ransomware group, with 12 GB reportedly exfiltrated and discovery on 2026-10-16. The entry is flagged as a duplicate: the same domain was previously listed against the Flocker group in 2025.

- **Published:** 2026-10-17T14:25:50Z
- **Last reviewed:** 2026-10-17T14:25:50Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3812
- **ID:** TL-2026-3812
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Vexy Ransomware
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-16 (16:55 UTC) Ransomware.live indexed a new leak-site claim by the Vexy ransomware group against Data-Core Systems (dcsdev.org), an IT consulting and technology services firm described in the listing as founded in 1988 and specializing in digital transformation and SAP implementation. The listing reports 12 GB of data exfiltrated and an estimated attack date of 2026-10-16. The victim country is not stated in the 2026 entry, no ransom amount is disclosed, and the tracker only indexes publicly visible leak-site information; it does not access or verify the stolen data. The claim is therefore an unverified extortion claim by the threat actor, and no technical artifacts specific to this intrusion (initial access vector, malware samples, hashes, C2) have been published.

The entry is flagged by Ransomware.live as a duplicate. A separate Ransomware.live entry for dcsdev.org (Data-Core Systems Inc.) attributes a listing to the Flocker group, discovered 2025-06-01 with an estimated attack date of 2025-05-25, country United States. That earlier entry describes the organization as 'The Automation Company' established in 2016, which differs from the 1988 founding date and the IT-consulting description in the Vexy entry; the two listings may describe different organizations sharing a domain label, or inconsistent self-descriptions, and this has not been resolved from the sources. The 2026 listing's exposure report notes 1 compromised password (0 critical) and 0 cookies; DNS shows GoDaddy/Secureserver hosting and no cloud/SaaS services were detected.

Vexy is an emerging ransomware operation first observed in mid-2026. Ransomware.live tracks 22 victims between an estimated first attack on 2026-07-06 and the Data-Core listing on 2026-10-16, with 799.6 GB of data exfiltrated across all victims, a single leak site on Tor, and two Bitcoin wallets used for ransom collection. Primary sectors are Technology (6 victims), Retail and E-Commerce (5) and Manufacturing (3); geographic focus is India (6), Brazil (3) and the United States (2), plus others. Ransomware.live correlates infostealer data with 68.2% of Vexy victims, and SOCRadar reports that operators obtain credentials from underground marketplaces, often harvested by infostealers, for initial access. The group operates a double-extortion model under an assessed closed or semi-private RaaS structure. Ransomware.live notes attack velocity declined about 75% versus the prior month.

A Security Arsenal analysis (2026-09-05) of the group's early victims offers an assessed, not confirmed, playbook: edge VPN/RMM exploitation, Windows privilege escalation, lateral movement over RDP/WMI, data staging and exfiltration, then staged encryption with volume shadow copy deletion, with a 5-14 day dwell time. Candidate entry vectors named there (CVE-2026-50751 in Check Point Security Gateway IKEv1, CVE-2024-1708 ScreenConnect, CVE-2025-60710, CVE-2023-21529 Exchange, CVE-2026-48027 Nx Console) are analyst hypotheses and are NOT linked to Data-Core Systems; they are not listed in this record's CVE list. Pre-encryption behaviors cited there include vssadmin delete shadows, wmic and diskshadow shadow copy operations, bcdedit recoveryenabled no, archiving with 7z/WinRAR/rar, PsExec/PsExesvc execution, WmiPrvSE spawning cmd.exe/powershell.exe, and new service installations (Event ID 7045). Defenders in technology and IT-services sectors should treat these as hunting leads for the group generally, not as confirmed activity at this victim.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1059.003 Windows Command Shell
- T1047 Windows Management Instrumentation
- T1569.002 Service Execution
- T1543.003 Windows Service
- T1021.001 Remote Desktop Protocol
- T1074.001 Local Data Staging
- T1560.001 Archive via Utility
- T1490 Inhibit System Recovery
- T1657 Financial Theft

## Sources

- [Ransomware.live - Data-Core Systems / Vexy Ransomware victim entry](https://www.ransomware.live/id/RGF0YS1Db3JlIFN5c3RlbXNAVmV4eSBSYW5zb213YXJl)
- [Ransomware.live - dcsdev.org / Flocker prior victim entry](https://www.ransomware.live/id/RGNzZGV2Lm9yZ0BmbG9ja2Vy)
- [Ransomware.live - Vexy Ransomware group profile](https://www.ransomware.live/group/Vexy%20Ransomware)
- [Security Arsenal - Vexy Ransomware Gang: 5 New Victims in 4 Days, India and LATAM Campaign, Sector Analysis and Detection Rules](https://securityarsenal.com/blog/vexy-ransomware-gang-5-new-victims-in-4-days-india-and-latam-campaign-sector-analysis-and-detection-rules)
- [SOCRadar - Groupe Proxitel Data Breach (Vexy Ransomware)](https://socradar.io/blog/data-breach/groupe-proxitel-vexy-ransomware-2026/)
- [SOCRadar Ransomware Intelligence - Vexy Ransomware group](https://socradar.io/free-tools/ransomware-intelligence/groups/vexy-ransomware)
- [DEXPOSE - Vexy Ransomware Strikes French Tech Firm Groupe Proxitel](https://www.dexpose.io/vexy-ransomware-strikes-french-tech-firm-groupe-proxitel/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3812