Threat reportRansomwareTL-2026-4929
Vexy Ransomware claims JHAMF Group (IT services) - 110 GB exfiltrated
Vexy Ransomware claims JHAMF Group (IT services) (TL-2026-4929) is a high-severity ransomware operation, first published 2026-10-31. It is attributed to Vexy Ransomware with low confidence, affects JHAMF Group Corporate IT environment (www.jhamf.com), maps to 6 MITRE ATT&CK techniques (T1078, T1135, T1485), and is covered by 9 detection rules and 12 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 6MITRE ATT&CK
- Actors
- 1Vexy Ransomware
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-4929
- Threat ID
- TL-2026-4929
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Vexy Ransomware
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, it-services, telecoms
- Target regions
- colombia, bangladesh
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in Vexy Ransomware claims JHAMF Group (IT services)
Malware and tooling: Vexy ESXi locker, Vexy Linux locker, Vexy Ransomware, Vexy Windows locker, Tor - S0183
How Vexy Ransomware claims JHAMF Group (IT services) works
Ransomware.live lists JHAMF Group (www.jhamf.com), an IT services company, as a victim of the Vexy Ransomware group, discovered 2026-10-31 with 110 GB of data claimed exfiltrated. The claim comes from a single aggregator and is not yet corroborated by the victim or a vendor; the listing's country flag (Bangladesh) conflicts with its description (Colombian).
Ransomware.live recorded JHAMF Group (www.jhamf.com), described as an IT infrastructure, telecommunications, software licensing and cloud solutions company, as a victim of the Vexy Ransomware group. The entry was discovered on 2026-10-31 at 19:04 UTC with an estimated attack date of 2026-10-31 and reports 110 GB of exfiltrated data. The listing's country flag is Bangladesh (BD), while the text describes the company as Colombian; the source does not resolve this discrepancy. No ransom amount, negotiation details, leak-site post content, onion link for the specific victim post, or IOC list is included in the listing, and neither the victim nor any vendor has confirmed the claim.
The listing also carries third-party exposure telemetry: HudsonRock infostealer intelligence reports 11 compromised employees (1 user and 10 third-party credentials) and an external attack surface of 12, and a ParanoidLab exposure report lists 341 exposed passwords (112 critical) and 1 exposed cookie. These figures show credential exposure at the victim but do not establish that the credentials were used in this intrusion. Other public reporting says Vexy operators commonly obtain credentials from underground markets, often harvested by infostealers, which fits the exposure data. That is a general characterization of the group, not an observed fact about this incident. The same listing notes the victim uses Microsoft 365 email.
Vexy is a ransomware-as-a-service operation. Its RaaS rules, effective 2026-09-02 and mirrored by RansomLook, describe an invitation-only affiliate program with a one-time USD 200 registration fee paid in Bitcoin and a Rust-written locker family. The Windows locker uses AES-256 data encryption with RSA key wrapping and supports exclusions, service termination, free-space wiping and ransom notes sent to printers. The Linux locker targets SMB/NFS network shares and local data. The ESXi locker targets VM datastores, terminates VMware services and deletes event logs. The program also offers a Tor control panel, configuration build tools, an analytics dashboard and 24/7 support. Ransomware.live lists 25 victims since an estimated first attack on 2026-07-06 (group discovered 2026-09-03), about 974.6 GB of reported exfiltrated data, and activity as recent as 2026-10-31. Victims are concentrated in India, Brazil and the United States, mainly in technology, retail and manufacturing. Vexy runs a double-extortion model with a named-victim leak site and a countdown. Delivery vectors and in-network tradecraft for Vexy are not documented in primary sources: Breachsense and DeXpose state they have no TTP data, and a SecurityArsenal list of candidate initial-access CVEs and lateral-movement techniques is explicitly assessed rather than observed, so it is not mapped here.
Defensive priority for JHAMF-like targets: reset and invalidate credentials and session cookies exposed in infostealer data, enforce MFA on Microsoft 365 and remote access, monitor for bulk data staging and egress, protect backups and hypervisors, and watch for mass service termination and shadow-copy deletion.
MITRE ATT&CK techniques used in TL-2026-4929
Initial Access
Discovery
Impact
T1485 Data Destruction; T1489 Service Stop; T1490 Inhibit System Recovery; T1657 Financial Theft
Affected products and versions in Vexy Ransomware claims JHAMF Group (IT services)
- JHAMF Group — Corporate IT environment (www.jhamf.com)
Remediation for Vexy Ransomware claims JHAMF Group (IT services)
Immediate actions
- Reset passwords and revoke sessions and cookies for accounts present in the HudsonRock and ParanoidLab exposure data
- Enforce MFA on Microsoft 365, VPN and remote-access services
- Review egress logs for large outbound transfers (about 110 GB claimed) around 2026-10-31
- Block and alert on access to the Vexy leak-site onion address from corporate networks
Workarounds
- Restrict ESXi management interfaces and SMB/NFS share exposure to least privilege
Longer-term hardening
- Monitor infostealer and credential-exposure feeds for employee and third-party accounts
- Maintain offline or immutable backups and isolate hypervisor management planes
- Deploy EDR with behavioral detection for mass service termination and shadow-copy deletion
Timeline of Vexy Ransomware claims JHAMF Group (IT services)
- Ransomware.live records the estimated attack date of Vexy's first listed victim.
- Vexy RaaS affiliate program rules take effect (invite-only, USD 200 BTC registration; Rust-based Windows, Linux and ESXi lockers).
- Ransomware.live records Vexy's discovery date; Breachsense lists first seen as 2026-09-04.
- SecurityArsenal reports five Vexy victims claimed between 2026-09-02 and 2026-09-04, mostly in India and Latin America.
- Vexy lists Data-Core Systems (US IT consulting) and threatens a full leak unless the company makes contact.
- Vexy lists polisee Inc.
- Vexy lists System Soft (Bulgaria) on the same day as JHAMF Group.
- Ransomware.live discovers the Vexy listing for JHAMF Group at 19:04 UTC, claiming 110 GB exfiltrated; HudsonRock and ParanoidLab exposure data queried the same day.
Sources cited for Vexy Ransomware claims JHAMF Group (IT services)
- Ransomware.live - JHAMF Group / Vexy Ransomware victim entry
- Ransomware.live - Vexy group profile
- RansomLook - Vexy RaaS rules
- Breachsense - Vexy ransomware group profile
- SecurityArsenal - Vexy Ransomware Gang: 5 New Victims in 4 Days
- DeXpose - Vexy Ransomware Strikes Data-Core Systems
- SOCRadar - Vexy Ransomware group intelligence
Detection coverage for TL-2026-4929
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4929 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.