# Vexy Ransomware claims System Soft (Bulgaria) - 65 GB exfiltrated

> The Vexy ransomware group has listed System Soft (systemsoft.info), a Bulgarian technology company, as a victim on its leak site, claiming 65 GB of exfiltrated data. Ransomware.live recorded the listing on 2026-10-31; no initial access vector has been publicly confirmed for this victim.

- **Published:** 2026-10-31T19:32:08Z
- **Last reviewed:** 2026-10-31T19:32:08Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4923
- **ID:** TL-2026-4923
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Vexy Ransomware
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Ransomware.live lists System Soft (systemsoft.info), a Bulgaria-based technology-sector organization, as a victim of the Vexy Ransomware group. The listing was discovered on 2026-10-31 with an estimated attack date of the same day and reports 65 GB of data exfiltrated. No ransom amount, sample files, or deadline were available in the tracker entry, and no victim statement or independent confirmation has been published, so the claim should be treated as an unverified extortion claim by the threat actor.

Enrichment attached to the tracker entry shows a ParanoidLab exposure report of 881 exposed passwords (16 of critical severity) and 0 cookies for the victim domain, plus HudsonRock infostealer data showing 0 compromised employees, 0 compromised users, and 3 third-party employee credentials. The victim's DNS uses the mail host mx.serviciodecorreo.es, and the tracker reports no major cloud/SaaS services and no external attack-surface exposures. These facts are consistent with, but do not prove, credential-based initial access: public reporting on Vexy (SOCRadar) states that operators obtain credentials from underground marketplaces, often harvested by infostealers, to gain initial access, and ransomware.live reports infostealer correlation for 68% of Vexy victims with domain indicators.

Vexy Ransomware is an emerging operation. Ransomware.live dates its first victim to an estimated 2026-07-06 (discovered 2026-09-03) and lists 25 victims and 974.6 GB of exfiltrated data across 15 countries, led by India, the United States, and Brazil, with Technology, Retail and E-Commerce, and Manufacturing the dominant sectors. The group runs a Tor leak site (Apache 2.4.68 on Debian) and operates a double-extortion model of data theft plus encryption, with a countdown timer and progressive data release for non-payers per a vendor blog. Two Bitcoin wallets and a Tox contact ID are associated with the group by ransomware.live.

A Security Arsenal vendor blog describes group behaviour as Windows-targeted encryption preceded by volume shadow copy deletion (vssadmin, wmic, diskshadow, bcdedit), service termination and backup-agent tampering, lateral movement with PsExec, WMI and RDP, and pre-exfiltration staging with 7z/WinRAR, with an estimated 5 to 14 days of dwell time. That blog also names candidate initial-access CVEs (including Check Point and ScreenConnect flaws) as speculative 'top candidates'; no source ties any CVE to the System Soft intrusion, so none are recorded in the CVE list. Defenders should hunt for the behaviours above, review credential exposure for the victim and its third parties, and watch for the group's leak-site indicators.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1047 Windows Management Instrumentation
- T1569.002 Service Execution
- T1021 Remote Services
- T1021.001 Remote Desktop Protocol
- T1560.001 Archive via Utility
- T1567 Exfiltration Over Web Service
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1657 Financial Theft

## Sources

- [Ransomware.live - System Soft / Vexy Ransomware victim entry](https://www.ransomware.live/id/U3lzdGVtIFNvZnRAVmV4eSBSYW5zb213YXJl)
- [Ransomware.live - Vexy Ransomware group profile](https://www.ransomware.live/group/Vexy%20Ransomware)
- [Security Arsenal - Vexy Ransomware Gang: 5 New Victims in 4 Days, sector analysis and detection rules](https://securityarsenal.com/blog/vexy-ransomware-gang-5-new-victims-in-4-days-india-and-latam-campaign-sector-analysis-and-detection-rules)
- [Breachsense - Vexy ransomware group profile](https://www.breachsense.com/ransomware-groups/vexy/)
- [SOCRadar - Groupe Proxitel Data Breach (Vexy Ransomware)](https://socradar.io/blog/data-breach/groupe-proxitel-vexy-ransomware-2026/)
- [SOCRadar - Vexy Ransomware group intelligence](https://socradar.io/free-tools/ransomware-intelligence/groups/vexy-ransomware)
- [DEXPOSE - Vexy Ransomware Strikes French Tech Firm Groupe Proxitel](https://www.dexpose.io/vexy-ransomware-strikes-french-tech-firm-groupe-proxitel/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4923