# Vexy Ransomware claims polisee Inc (AI policy intelligence platform) as victim

> ransomware.live lists polisee Inc (polisee.com), a Japanese AI-powered policy intelligence platform vendor (tracker country field: United States), as a victim of the Vexy Ransomware group. The incident was discovered 2026-10-17 with an estimated attack date of 2026-10-16; the data exposure type is recorded as encrypted only.

- **Published:** 2026-10-17T19:25:02Z
- **Last reviewed:** 2026-10-17T19:25:02Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3833
- **ID:** TL-2026-3833
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Vexy Ransomware
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ransomware.live recorded polisee Inc (polisee.com) as a victim of the Vexy Ransomware group, discovered 2026-10-17 18:33 UTC with an estimated attack date of 2026-10-16. The tracker describes polisee as a Japanese technology firm providing an AI-powered policy intelligence platform that monitors government policies and regulatory data and automates collection and analysis of policy information to support compliance and regulatory-opportunity identification. The tracker's country field reads United States; the sector is recorded as Technology. The sector list shown on the tracker page (agriculture, education, energy, financial services, government, healthcare, hospitality, manufacturing, professional services, retail, transportation) reflects the platform's multi-sector coverage and is not asserted as the victim's sector. Tracker enrichment notes Microsoft 365 email, a HubSpot integration and GoDaddy-managed DNS. ParanoidLab enrichment found no critical password or cookie compromises as of the query date, and the exposure type is 'encrypted only'. The tracker page contains no onion address, TTPs, tools, screenshots, hashes or ransom-note text for this specific incident. This is a leak-site claim and has not been confirmed by the victim in any source reviewed.

Group context (secondary trackers): Vexy is an emerging ransomware operation first observed in mid-2026. SecurityArsenal (2026-09-05) characterises it as a closed/semi-private RaaS with a small core operator set and limited affiliate recruitment, using double extortion with a countdown on its leak site and progressive release of data samples for non-payers. Breachsense reports 22 named victims with the most recent on 2026-10-17 (India 9, Brazil 3, France 2; Manufacturing 6 and Technology 4 the leading sectors) and records the leak site as an onion service. ransomware.live-derived statistics cite 23 victims, 799.6 GB exfiltrated across 22 of them, 13 countries, an average 17-day delay between attack and discovery, and infostealer data for 65.2% of victims; the leak site runs Apache 2.4.68 on Debian.

IMPORTANT sourcing caveat: the initial-access vector for Vexy is NOT established. SecurityArsenal lists candidate vectors (CVE-2026-50751 Check Point IKEv1 gateway flaw as 'top candidate', CVE-2024-1708 ScreenConnect, CVE-2025-60710 Windows privilege escalation, CVE-2023-21529 Exchange, CVE-2026-48027 Nx Console) as analyst assessments based on victim geography, not observed evidence, and none is linked to polisee; they are therefore excluded from cve_list. The playbook and MITRE mapping below (RMM/VPN exploitation, privilege escalation, RDP/WMI/PsExec lateral movement, 7z/WinRAR staging, VSS deletion via vssadmin/wmic/diskshadow/bcdedit, encryption) come from the same single secondary source and are an assessed group-level playbook, not victim-specific forensic findings. Defenders should treat polisee-specific impact as a claim pending victim confirmation.

## MITRE ATT&CK

- T1490 Inhibit System Recovery
- T1657 Financial Theft
- T1021 Remote Services
- T1047 Windows Management Instrumentation
- T1569.002 Service Execution
- T1560.001 Archive via Utility

## Sources

- [ransomware.live incident record: polisee Inc / Vexy Ransomware](https://www.ransomware.live/id/cG9saXNlZSBJbmNAVmV4eSBSYW5zb213YXJl)
- [Vexy Ransomware group profile - ransomware.live](https://www.ransomware.live/group/Vexy%20Ransomware)
- [Vexy Ransomware Gang: 5 New Victims in 4 Days - SecurityArsenal](https://securityarsenal.com/blog/vexy-ransomware-gang-5-new-victims-in-4-days-india-and-latam-campaign-sector-analysis-and-detection-rules)
- [Vexy ransomware group profile - Breachsense](https://www.breachsense.com/ransomware-groups/vexy/)
- [Groupe Proxitel Data Breach (Vexy Ransomware) - SOCRadar](https://socradar.io/blog/data-breach/groupe-proxitel-vexy-ransomware-2026/)
- [Vexy Ransomware Targets Italian Fashion House STP Fashion Lab - DExpose](https://www.dexpose.io/vexy-ransomware-targets-italian-fashion-house-stp-fashion-lab/)
- [Vexy Ransomware Targets Logar Network Solutions in Brazil - DExpose](https://www.dexpose.io/vexy-ransomware-targets-logar-network-solutions-in-brazil/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3833