# Vexy Ransomware claims JHAMF Group (IT services) - 110 GB exfiltrated

> Ransomware.live lists JHAMF Group (www.jhamf.com), an IT services company, as a victim of the Vexy Ransomware group, discovered 2026-10-31 with 110 GB of data claimed exfiltrated. The claim comes from a single aggregator and is not yet corroborated by the victim or a vendor; the listing's country flag (Bangladesh) conflicts with its description (Colombian).

- **Published:** 2026-10-31T20:57:27Z
- **Last reviewed:** 2026-10-31T20:57:27Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4929
- **ID:** TL-2026-4929
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Vexy Ransomware
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Ransomware.live recorded JHAMF Group (www.jhamf.com), described as an IT infrastructure, telecommunications, software licensing and cloud solutions company, as a victim of the Vexy Ransomware group. The entry was discovered on 2026-10-31 at 19:04 UTC with an estimated attack date of 2026-10-31 and reports 110 GB of exfiltrated data. The listing's country flag is Bangladesh (BD), while the text describes the company as Colombian; the source does not resolve this discrepancy. No ransom amount, negotiation details, leak-site post content, onion link for the specific victim post, or IOC list is included in the listing, and neither the victim nor any vendor has confirmed the claim.

The listing also carries third-party exposure telemetry: HudsonRock infostealer intelligence reports 11 compromised employees (1 user and 10 third-party credentials) and an external attack surface of 12, and a ParanoidLab exposure report lists 341 exposed passwords (112 critical) and 1 exposed cookie. These figures show credential exposure at the victim but do not establish that the credentials were used in this intrusion. Other public reporting says Vexy operators commonly obtain credentials from underground markets, often harvested by infostealers, which fits the exposure data. That is a general characterization of the group, not an observed fact about this incident. The same listing notes the victim uses Microsoft 365 email.

Vexy is a ransomware-as-a-service operation. Its RaaS rules, effective 2026-09-02 and mirrored by RansomLook, describe an invitation-only affiliate program with a one-time USD 200 registration fee paid in Bitcoin and a Rust-written locker family. The Windows locker uses AES-256 data encryption with RSA key wrapping and supports exclusions, service termination, free-space wiping and ransom notes sent to printers. The Linux locker targets SMB/NFS network shares and local data. The ESXi locker targets VM datastores, terminates VMware services and deletes event logs. The program also offers a Tor control panel, configuration build tools, an analytics dashboard and 24/7 support. Ransomware.live lists 25 victims since an estimated first attack on 2026-07-06 (group discovered 2026-09-03), about 974.6 GB of reported exfiltrated data, and activity as recent as 2026-10-31. Victims are concentrated in India, Brazil and the United States, mainly in technology, retail and manufacturing. Vexy runs a double-extortion model with a named-victim leak site and a countdown. Delivery vectors and in-network tradecraft for Vexy are not documented in primary sources: Breachsense and DeXpose state they have no TTP data, and a SecurityArsenal list of candidate initial-access CVEs and lateral-movement techniques is explicitly assessed rather than observed, so it is not mapped here.

Defensive priority for JHAMF-like targets: reset and invalidate credentials and session cookies exposed in infostealer data, enforce MFA on Microsoft 365 and remote access, monitor for bulk data staging and egress, protect backups and hypervisors, and watch for mass service termination and shadow-copy deletion.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1135 Network Share Discovery
- T1489 Service Stop
- T1490 Inhibit System Recovery
- T1485 Data Destruction
- T1657 Financial Theft

## Sources

- [Ransomware.live - JHAMF Group / Vexy Ransomware victim entry](https://www.ransomware.live/id/SkhBTUYgR3JvdXBAVmV4eSBSYW5zb213YXJl)
- [Ransomware.live - Vexy group profile](https://www.ransomware.live/group/vexy)
- [RansomLook - Vexy RaaS rules](https://www.ransomlook.io/group/vexy/raas-rules)
- [Breachsense - Vexy ransomware group profile](https://www.breachsense.com/ransomware-groups/vexy/)
- [SecurityArsenal - Vexy Ransomware Gang: 5 New Victims in 4 Days](https://securityarsenal.com/blog/vexy-ransomware-gang-5-new-victims-in-4-days-india-and-latam-campaign-sector-analysis-and-detection-rules)
- [DeXpose - Vexy Ransomware Strikes Data-Core Systems](https://www.dexpose.io/vexy-ransomware-strikes-data-core-systems/)
- [SOCRadar - Vexy Ransomware group intelligence](https://socradar.io/free-tools/ransomware-intelligence/groups/vexy-ransomware)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4929