Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated

Key facts for Vexy Ransomware ZipAI leak

Detection coverage for Vexy Ransomware ZipAI leak

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5356 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Vexy Ransomware (TL-2026-5356) - Valid Account Success After Credential Stuffing Burst

Finds source IPs with 10+ failed Entra ID sign-ins across 3+ accounts followed by at least one success within 24 hours. Vexy Ransomware operators reportedly buy infostealer-harvested credentials and replay them for initial access (T1078); this is the replay-then-success pattern. Group-level behaviour, not confirmed for ZipAI.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1078, T1589
• Data sources: azure:aad:signin (Splunk Add-on for Microsoft Cloud Services), Microsoft Entra ID SigninLogs
• Severity: high
• Confidence: medium

Splunk SPL

index=azure sourcetype="azure:aad:signin" earliest=-24h
| eval ok=if('status.errorCode'=0,1,0), bad=if('status.errorCode' IN (50053,50126,50057),1,0)
| stats min(_time) as first_seen max(_time) as last_seen sum(bad) as failures sum(ok) as successes dc(userPrincipalName) as distinct_users values(userPrincipalName) as accounts by ipAddress
| where failures>=10 AND successes>=1 AND distinct_users>=3
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table first_seen last_seen ipAddress failures successes distinct_users accounts

Microsoft KQL

SigninLogs
| where TimeGenerated > ago(24h)
| extend Code = tostring(ResultType)
| summarize Failures = countif(Code in ("50053", "50126", "50057")), Successes = countif(Code == "0"), DistinctUsers = dcount(UserPrincipalName), Accounts = make_set(UserPrincipalName, 20), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by IPAddress
| where Failures >= 10 and Successes >= 1 and DistinctUsers >= 3
| project FirstSeen, LastSeen, IPAddress, Failures, Successes, DistinctUsers, Accounts

Sigma

name: vexy_failed_signin_burst
title: Vexy Ransomware TL-2026-5356 - Failed Sign-in Burst Across Many Accounts From One IP
id: 5b1f7c2e-3a64-4d0b-9c71-8e2a6f4d1b01
status: experimental
description: Detects failed Entra ID sign-ins from one source IP, the replay pattern of infostealer-harvested credentials (valid account initial access reported for Vexy Ransomware). Use the correlation document below for the many-accounts condition and correlate with a later success from the same IP in the SIEM.
references:
    - https://www.ransomware.live/group/Vexy%20Ransomware
    - https://www.ransomware.live/id/WmlwQUlAVmV4eSBSYW5zb213YXJl
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
    - attack.initial-access
    - attack.t1078
    - attack.t1078.004
    - attack.reconnaissance
    - attack.t1589.001
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        ResultType:
            - 50053
            - 50126
            - 50057
    condition: selection
falsepositives:
    - Misconfigured service accounts or legacy clients retrying with stale passwords
    - Shared NAT egress with many users mistyping passwords after a forced reset
level: medium
---
title: Vexy TL-2026-5356 Credential Replay Correlation
id: 5b1f7c2e-3a64-4d0b-9c71-8e2a6f4d1b02
status: experimental
description: Correlation of failed sign-ins spanning 3 or more distinct accounts from one IP within one hour.
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
correlation:
    type: value_count
    rules:
        - vexy_failed_signin_burst
    group-by:
        - IPAddress
    timespan: 1h
    condition:
        gte: 3
        field: UserPrincipalName
level: medium

Known false positives:

• Password-reset waves or legacy clients with stale credentials behind shared NAT
• Penetration tests or red-team credential audits

Tuning notes: Raise or lower the failure and distinct_users thresholds to match baseline. Exclude corporate egress IPs and known scanners via a lookup. Add status.errorCode 50055 if forced-reset retries are not noisy. Confirm index and sourcetype names match your Entra ingestion.

• 🔒 Vexy Ransomware (TL-2026-5356) - Successful Sign-in From Previously Unseen Country · unlock with TL Creds
• 🔒 Vexy Ransomware (TL-2026-5356) - Password-Protected Or Split Archive Staging · unlock with TL Creds
• 🔒 Vexy Ransomware (TL-2026-5356) - Leak Site, Wallet And Tox IOC Retrohunt · unlock with TL Creds
• 🔒 Vexy Ransomware (TL-2026-5356) - Successful Sign-in With Leaked Credential Or Anonymizer Risk · unlock with TL Creds
• 🔒 Vexy Ransomware (TL-2026-5356) - Rclone Or MEGA Client Execution · unlock with TL Creds
• 🔒 Vexy Ransomware (TL-2026-5356) - Tor Onion Or Tor2web DNS Lookup · unlock with TL Creds
• 🔒 Vexy Ransomware (TL-2026-5356) - Browser Credential Store Access By Non-Browser Process · unlock with TL Creds
• 🔒 Vexy Ransomware (TL-2026-5356) - Bulk Outbound Transfer Over 1 GB To Single External Host · unlock with TL Creds

Indicators of compromise for Vexy Ransomware ZipAI leak

As of 2026-11-05, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-5356.

Sample indicators (2 of 13)

• Domain: vexytsr3chimdz6siwaqi2lvxxwfkxvffkpwyanr2llequ2hkm56jvqd[.]onion
• URL: hxxps://www[.]ransomware[.]live/id/WmlwQUlAVmV4eSBSYW5zb213YXJl

Defanged, TLP:CLEAR. Full set of 13 indicators: unlock with TL Creds.

How Vexy Ransomware ZipAI leak works

Ransomware.live recorded a new victim claim by the Vexy Ransomware group on 2026-11-05 (23:27 UTC discovery, estimated attack date 2026-11-05). The victim is ZipAI (zipai.vn), a Vietnam-based AI technology platform offering image generation and editing, voice generation, video personalization and chatbot development, with services such as photo restoration, face-swapping, virtual clothing modification and product image editing. The listing reports 15.73 GB of data exfiltrated. The ParanoidLab exposure note attached to the listing reports 0 exposed passwords and 0 exposed cookies for the domain. DNS data shows an SPF record of v=spf1 a mx -all, no MX records, no identified cloud/SaaS services and no WHOIS emails. The source does not independently confirm the claim and does not describe the intrusion method, malware variant or any encryption activity for this victim.

Vexy Ransomware is an emerging data-extortion group. Per the ransomware.live group profile, its earliest estimated attack date is 2026-07-06 and its first discovered listing is 2026-09-03; it had listed 26 victims across 15 countries as of 2026-11-05 (India 6, United States 3, Brazil 3, Vietnam 2), with Technology (9), Retail and E-Commerce (5) and Manufacturing (3) the leading sectors. About 990.3 GB of exfiltrated data is reported across 25 of 26 victims, with an average delay of 17 days between attack and disclosure. The profile reports that 65.4% of victims overlap with infostealer infections, and security-vendor coverage (as summarized in search results) states that Vexy operators obtain infostealer-harvested credentials from underground marketplaces for initial access. That is a group-level observation, not a confirmed vector for ZipAI. The group runs a Tor leak site (Apache 2.4.68 on Debian, about 93.2% 30-day uptime) and has used a threat to publish a full data dump unless the victim negotiates, as quoted in a Quy Nhon University (Vietnam, 2026-09-19) listing.

Defensive relevance: organizations in the group's targeted sectors should treat infostealer-derived credential exposure as the most likely precursor, monitor for credential reuse and unusual bulk data egress, and use the leak-site and wallet indicators below for retrospective hunting. Variant details, ransom note text and encryption behavior are not documented in the available sources.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts

Credential Access

T1555 Credentials from Password Stores

Exfiltration

T1567 Exfiltration Over Web Service

Reconnaissance

T1589 Gather Victim Identity Information

Impact

T1657 Financial Theft

Remediation for Vexy Ransomware ZipAI leak

Immediate actions

• Reset credentials and revoke active sessions for accounts potentially exposed to infostealers; enforce MFA on all remote access and SaaS accounts
• Review egress logs for large outbound transfers (tens of GB) to unfamiliar hosts or cloud storage around 2026-10-20 to 2026-11-05
• Hunt for the Vexy leak-site onion address, Tox ID and Bitcoin wallets listed in the IOCs in proxy, DNS and email-gateway telemetry
• Verify the claim with the victim or leak-site evidence before treating data as confirmed compromised

Workarounds

• Restrict administrative and remote access paths to managed devices and conditional-access policies
• Segment data stores holding customer-generated media from general corporate networks

Longer-term hardening

• Monitor underground markets and infostealer log feeds for corporate credentials and cookies
• Deploy EDR with infostealer and bulk data-staging detections
• Maintain offline, tested backups and an incident response plan including extortion-negotiation and notification procedures
• Apply data-loss-prevention and egress volume alerting on data stores holding customer images, voice and video content

Affected and fixed versions

• ZipAI — ZipAI AI media and chatbot platform (zipai.vn)

Timeline of Vexy Ransomware ZipAI leak

• 2026-07-06 Earliest estimated locked-ioc-10 attack date recorded by ransomware.live
• 2026-09-03 First locked-ioc-10 victim listing discovered by ransomware.live
• 2026-09-07 Vexy claims locked-ioc-7 (Argentina)
• 2026-09-19 Vexy claims locked-ioc-8 (Vietnam) and threatens to release the full dump unless the victim negotiates
• 2026-09-29 Vexy claims locked-ioc-11
• 2026-10-06 Vexy claims locked-ioc-9 (France)
• 2026-11-05 Ransomware.live reports 26 total Vexy victims across 15 countries, with about 990.3 GB exfiltrated overall
• 2026-11-05 locked-ioc-10 lists locked-ioc-13 (locked-ioc-12, Vietnam, Technology) with 15.73 GB exfiltrated; discovered 23:27 UTC

Sources cited for Vexy Ransomware ZipAI leak

• Ransomware.live - ZipAI / Vexy Ransomware victim listing ransomware.live · Research · 2026-11-05
• Ransomware.live - Vexy Ransomware group profile ransomware.live · Research · 2026-11-05
• SOCRadar - Vexy Ransomware group intelligence socradar.io · Research · 2026-11-05
• SOCRadar - Groupe Proxitel Data Breach (Vexy Ransomware) socradar.io · Blog · 2026-09-29
• DeXpose - Vexy Ransomware Targets Quy Nhon University in Vietnam dexpose.io · News · 2026-09-19
• DeXpose - Vexy Ransomware Hits KOOKABARRA JUICE dexpose.io · News · 2026-10-06
• DeXpose - Vexy Ransomware Strikes at Libreria Santa Fe dexpose.io · News · 2026-09-07

More in ransomware

• HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files
• Queens Public Library Ransomware Attack Disrupts Wi-Fi, On-Site Computers and Digital Services
• Higher Education Sector Under Ransomware and Extortion Pressure: Interlock (CCBC, Springfield Public Schools) and ShinyHunters (Instructure Canvas) with AI Data-Exposure Risk
• The State of Ransomware in Financial Services 2026 (Sophos survey)
• Nova (formerly RALord) Ransomware-as-a-Service Group

Related coverage of this activity

• Vexy juice manufacturer ransomware
• Vexy Ransomware Guarufilme
• Vexy ransomware leak listing