Threat reportRansomwareTL-2026-4923
Vexy Ransomware claims System Soft (Bulgaria) - 65 GB exfiltrated
Vexy Ransomware claims System Soft (Bulgaria) (TL-2026-4923) is a high-severity ransomware operation, first published 2026-10-31. It is attributed to Vexy Ransomware with medium confidence, affects System Soft systemsoft.info organization (Bulgaria, technology sector), maps to 10 MITRE ATT&CK techniques (T1021, T1021.001, T1047), and is covered by 9 detection rules and 12 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 10MITRE ATT&CK
- Actors
- 1Vexy Ransomware
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-4923
- Threat ID
- TL-2026-4923
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Vexy Ransomware
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- technology, retail, manufacturing
- Target regions
- Europe, Asia, 005 - South America, North America
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in Vexy Ransomware claims System Soft (Bulgaria)
Malware and tooling: Vexy Ransomware, 7-Zip / WinRAR, PSEXEC
How Vexy Ransomware claims System Soft (Bulgaria) works
The Vexy ransomware group has listed System Soft (systemsoft.info), a Bulgarian technology company, as a victim on its leak site, claiming 65 GB of exfiltrated data. Ransomware.live recorded the listing on 2026-10-31; no initial access vector has been publicly confirmed for this victim.
Ransomware.live lists System Soft (systemsoft.info), a Bulgaria-based technology-sector organization, as a victim of the Vexy Ransomware group. The listing was discovered on 2026-10-31 with an estimated attack date of the same day and reports 65 GB of data exfiltrated. No ransom amount, sample files, or deadline were available in the tracker entry, and no victim statement or independent confirmation has been published, so the claim should be treated as an unverified extortion claim by the threat actor.
Enrichment attached to the tracker entry shows a ParanoidLab exposure report of 881 exposed passwords (16 of critical severity) and 0 cookies for the victim domain, plus HudsonRock infostealer data showing 0 compromised employees, 0 compromised users, and 3 third-party employee credentials. The victim's DNS uses the mail host mx.serviciodecorreo.es, and the tracker reports no major cloud/SaaS services and no external attack-surface exposures. These facts are consistent with, but do not prove, credential-based initial access: public reporting on Vexy (SOCRadar) states that operators obtain credentials from underground marketplaces, often harvested by infostealers, to gain initial access, and ransomware.live reports infostealer correlation for 68% of Vexy victims with domain indicators.
Vexy Ransomware is an emerging operation. Ransomware.live dates its first victim to an estimated 2026-07-06 (discovered 2026-09-03) and lists 25 victims and 974.6 GB of exfiltrated data across 15 countries, led by India, the United States, and Brazil, with Technology, Retail and E-Commerce, and Manufacturing the dominant sectors. The group runs a Tor leak site (Apache 2.4.68 on Debian) and operates a double-extortion model of data theft plus encryption, with a countdown timer and progressive data release for non-payers per a vendor blog. Two Bitcoin wallets and a Tox contact ID are associated with the group by ransomware.live.
A Security Arsenal vendor blog describes group behaviour as Windows-targeted encryption preceded by volume shadow copy deletion (vssadmin, wmic, diskshadow, bcdedit), service termination and backup-agent tampering, lateral movement with PsExec, WMI and RDP, and pre-exfiltration staging with 7z/WinRAR, with an estimated 5 to 14 days of dwell time. That blog also names candidate initial-access CVEs (including Check Point and ScreenConnect flaws) as speculative 'top candidates'; no source ties any CVE to the System Soft intrusion, so none are recorded in the CVE list. Defenders should hunt for the behaviours above, review credential exposure for the victim and its third parties, and watch for the group's leak-site indicators.
MITRE ATT&CK techniques used in TL-2026-4923
Lateral Movement
T1021 Remote Services; T1021.001 Remote Desktop Protocol
Execution
T1047 Windows Management Instrumentation; T1569.002 Service Execution
Initial Access
Impact
T1489 Service Stop; T1490 Inhibit System Recovery; T1657 Financial Theft
Collection
Exfiltration
Affected products and versions in Vexy Ransomware claims System Soft (Bulgaria)
- System Soft — systemsoft.info organization (Bulgaria, technology sector)
Remediation for Vexy Ransomware claims System Soft (Bulgaria)
Patches
- Keep internet-facing edge devices and remote-management software fully patched; no CVE is confirmed for this incident
Immediate actions
- Force password resets and revoke sessions for accounts appearing in infostealer or ParanoidLab exposure data, prioritising the 16 critical-severity exposures
- Enforce MFA on VPN, RDP, email and remote-management (RMM) access
- Hunt for vssadmin/wmic/diskshadow/bcdedit shadow-copy deletion and PsExec/WMI remote execution
- Block and alert on the Vexy leak-site onion address and review egress for multi-gigabyte transfers to cloud storage or VPS hosts
Workarounds
- Disable or restrict RDP exposure and PsExec/WMI remote execution between non-administrative hosts
- Alert on bulk archive creation (7z/WinRAR) on servers and file shares
Longer-term hardening
- Deploy EDR with ransomware behavioral detection and tamper protection
- Maintain offline, immutable backups and test restoration
- Monitor underground credential markets and infostealer feeds for corporate and third-party credential exposure
- Restrict internet-exposed RDP and remote-management tooling and segment the network
Timeline of Vexy Ransomware claims System Soft (Bulgaria)
- Ransomware.live gives an estimated attack date of 2026-07-06 for the first Vexy Ransomware victim.
- Vexy Ransomware's first victim listing is discovered by Ransomware.live; Breachsense records the group as first seen 2026-09-04.
- Vexy lists Groupe Proxitel, a Timor-Leste telecommunications and technology company, on its leak site (SOCRadar).
- Breachsense records Vexy's most recent victim post as 2026-10-19, with 23 total victims tracked.
- Ransomware.live shows Vexy still active, with 25 victims and 974.6 GB of exfiltrated data across 15 countries.
- System Soft is listed as a Vexy Ransomware victim at 19:04 UTC with 65 GB claimed exfiltrated; ParanoidLab reports 881 exposed passwords (16 critical) for the domain.
- Estimated attack date for System Soft (systemsoft.info), Bulgaria.
Sources cited for Vexy Ransomware claims System Soft (Bulgaria)
- Ransomware.live - System Soft / Vexy Ransomware victim entry
- Ransomware.live - Vexy Ransomware group profile
- Security Arsenal - Vexy Ransomware Gang: 5 New Victims in 4 Days, sector analysis and detection rules
- Breachsense - Vexy ransomware group profile
- SOCRadar - Groupe Proxitel Data Breach (Vexy Ransomware)
- SOCRadar - Vexy Ransomware group intelligence
- DEXPOSE - Vexy Ransomware Strikes French Tech Firm Groupe Proxitel
Detection coverage for TL-2026-4923
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4923 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.