Vexy Ransomware claims Albion Online Data Project (16 GB exfiltrated)

Key facts

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5578 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Vexy Ransomware - Pre-Encryption Recovery Inhibition and Data Staging (T1490, T1486, T1560.001, T1074) [Splunk]

Detects the pre-encryption and staging behaviours listed as research IOCs for TL-2026-5578: vssadmin delete shadows /all /quiet, wmic shadowcopy delete, diskshadow.exe, bcdedit recovery disabling, wbadmin backup deletion, password-protected 7z/rar archiving, and robocopy /MIR staging. These behaviours are assessed from comparable ransomware groups (Security Arsenal) and are NOT confirmed as Vexy-specific; Vexy is a double-extortion group that exfiltrated 16 GB from the claimed victim, so staging and recovery inhibition are strong precursors to exfiltration and encryption.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1490, T1486, T1560.001, T1074
• Data sources: sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational (EventCode 1)
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| eval img=lower(Image), cmd=lower(CommandLine)
```comment: recovery inhibition T1490 and archive or copy staging T1560.001 and T1074```
| eval behaviour=case(match(img,"vssadmin\.exe$") AND like(cmd,"%delete%") AND like(cmd,"%shadows%"), "vssadmin delete shadows T1490", match(img,"wmic\.exe$") AND like(cmd,"%shadowcopy%") AND like(cmd,"%delete%"), "wmic shadowcopy delete T1490", match(img,"diskshadow\.exe$"), "diskshadow execution T1490", match(img,"bcdedit\.exe$") AND (like(cmd,"%recoveryenabled%no%") OR like(cmd,"%ignoreallfailures%")), "bcdedit recovery disabled T1490", match(img,"wbadmin\.exe$") AND (like(cmd,"%delete catalog%") OR like(cmd,"%delete backup%") OR like(cmd,"%delete systemstatebackup%")), "wbadmin backup deletion T1490", match(img,"(7z|7za|rar|winrar)\.exe$") AND like(cmd,"% a %") AND (like(cmd,"% -hp%") OR like(cmd,"% -p%")), "password-protected archive staging T1560.001", match(img,"robocopy\.exe$") AND like(cmd,"%/mir%"), "robocopy /MIR staging T1074")
| where isnotnull(behaviour)
| stats count, min(_time) AS first_seen, max(_time) AS last_seen, values(CommandLine) AS commands, values(ParentImage) AS parents BY host, User, behaviour
| convert ctime(first_seen) ctime(last_seen)
| eval threat_id="TL-2026-5578", technique="T1490,T1486,T1560.001,T1074"
| table host User behaviour count commands parents first_seen last_seen threat_id technique

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| extend Img = tolower(FileName), Cmd = tolower(ProcessCommandLine)
| extend Behaviour = case(
    Img == "vssadmin.exe" and Cmd contains "delete" and Cmd contains "shadows", "vssadmin delete shadows T1490",
    Img == "wmic.exe" and Cmd contains "shadowcopy" and Cmd contains "delete", "wmic shadowcopy delete T1490",
    Img == "diskshadow.exe", "diskshadow execution T1490",
    Img == "bcdedit.exe" and (Cmd contains "recoveryenabled" and Cmd contains " no" or Cmd contains "ignoreallfailures"), "bcdedit recovery disabled T1490",
    Img == "wbadmin.exe" and (Cmd contains "delete catalog" or Cmd contains "delete backup" or Cmd contains "delete systemstatebackup"), "wbadmin backup deletion T1490",
    Img in ("7z.exe", "7za.exe", "rar.exe", "winrar.exe") and Cmd contains " a " and (Cmd contains " -hp" or Cmd contains " -p"), "password-protected archive staging T1560.001",
    Img == "robocopy.exe" and Cmd contains "/mir", "robocopy /MIR staging T1074",
    "")
| where Behaviour != ""
| project Timestamp, DeviceName, AccountName, Behaviour, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine

Sigma

title: Vexy Ransomware - Pre-Encryption Recovery Inhibition and Data Staging (T1490, T1560.001, T1074)
id: 2a9f5c61-b3d8-4e70-a4c2-7e1f9d086b35
status: experimental
description: Detects shadow copy deletion (vssadmin, wmic, diskshadow), bcdedit and wbadmin recovery inhibition, password-protected archiving and robocopy /MIR staging commonly seen before ransomware encryption and double-extortion exfiltration. Assessed from comparable groups and not confirmed as Vexy-specific for TL-2026-5578.
references:
    - https://securityarsenal.com/blog/vexy-ransomware-gang-5-new-victims-in-4-days-india-and-latam-campaign-sector-analysis-and-detection-rules
    - https://www.ransomware.live/group/Vexy%20Ransomware
author: Threadlinqs Team
date: 2026-11-09
tags:
    - attack.impact
    - attack.t1490
    - attack.t1486
    - attack.collection
    - attack.t1560.001
    - attack.t1074
logsource:
    category: process_creation
    product: windows
detection:
    selection_recovery_vss:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'shadows'
    selection_recovery_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains|all:
            - 'shadowcopy'
            - 'delete'
    selection_recovery_diskshadow:
        Image|endswith: '\diskshadow.exe'
    selection_recovery_bcdedit:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains:
            - 'recoveryenabled no'
            - 'ignoreallfailures'
    selection_recovery_wbadmin:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains:
            - 'delete catalog'
            - 'delete backup'
            - 'delete systemstatebackup'
    selection_archive:
        Image|endswith:
            - '\7z.exe'
            - '\7za.exe'
            - '\rar.exe'
            - '\winrar.exe'
        CommandLine|contains: ' a '
    selection_archive_password:
        CommandLine|contains:
            - ' -hp'
            - ' -p'
    selection_robocopy:
        Image|endswith: '\robocopy.exe'
        CommandLine|contains: '/mir'
    condition: 1 of selection_recovery_* or (selection_archive and selection_archive_password) or selection_robocopy
falsepositives:
    - Backup and disaster-recovery software that manages shadow copies
    - Administrators performing legitimate archiving or robocopy mirroring
level: critical

Known false positives:

• Backup, imaging and disaster-recovery software that manages or deletes shadow copies
• Administrators performing legitimate password-protected archiving or robocopy /MIR mirroring
• Software installers that run bcdedit or diskshadow during maintenance

Tuning notes: Adjust index/sourcetype to your Sysmon onboarding. Treat the T1490 branches as high-fidelity and page on them; the archive and robocopy branches are hunting-grade, so allow-list approved backup servers, service accounts and scheduled jobs. Add a size or file-count threshold from file-creation telemetry to match ~16 GB staging volumes.

• 🔒 Vexy Ransomware - External RDP Logon After Failure Burst (Valid Accounts T1078) [Sentinel] · unlock with TL Creds
• 🔒 Vexy Ransomware - PsExec and WMI Remote Execution for Lateral Movement (T1569.002, T1047) [Sentinel] · unlock with TL Creds
• 🔒 Vexy Ransomware - Pre-Encryption Recovery Inhibition and Data Staging (T1490, T1486, T1560.001, T1074) [Sentinel] · unlock with TL Creds
• 🔒 Vexy Ransomware - External RDP Logon With Valid Account (T1078) [Sigma] · unlock with TL Creds
• 🔒 Vexy Ransomware - PsExec and WMI Remote Execution (T1569.002, T1047) [Sigma] · unlock with TL Creds
• 🔒 Vexy Ransomware - Pre-Encryption Recovery Inhibition and Data Staging (T1490, T1486, T1560.001, T1074) [Sigma] · unlock with TL Creds
• 🔒 Vexy Ransomware - External RDP Logon After Failure Burst (Valid Accounts T1078) [Splunk] · unlock with TL Creds
• 🔒 Vexy Ransomware - PsExec and WMI Remote Execution for Lateral Movement (T1569.002, T1047) [Splunk] · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-5578.

Sample indicators (2 of 10)

• Domain: albion-online-data[.]com
• URL: hxxps://www[.]ransomware[.]live/id/QWxiaW9uIE9ubGluZSBEYXRhIFByb2plY3RAVmV4eSBSYW5zb213YXJl

Defanged, TLP:CLEAR. Full set of 10 indicators: unlock with TL Creds.

Technical analysis

Ransomware.live recorded a Vexy Ransomware leak-site claim against Albion Online Data Project (www.albion-online-data.com) on 2026-11-09 at 19:08 UTC, with an estimated attack date of 2026-11-07. The victim is a US-based technology-sector community platform that publishes real-time and historical market prices and orders for the MMORPG Albion Online, and also provides APIs, data feeds and client software. The tracker reports 16 GB of data exfiltrated. No leak or download links were listed at the time of discovery. This is a group claim from a single tracker page and has not been confirmed by the victim or independently verified. The platform is a community project and is not the game publisher; the 2020 Albion Online forum breach is an unrelated historical incident.

The ransomware.live exposure report (ParanoidLab) for the victim domain shows 0 exposed passwords and 3 cookies from infostealer data, none critical. WHOIS shows privacy-protected registration with a Namecheap abuse contact; no MX, TXT or SaaS records were found.

Vexy Ransomware is a 2026 double-extortion operation. Ransomware.live lists 26 victims across 15 countries (India 6, United States 3, Brazil 3, Viet Nam 2, Bulgaria 1), mostly Technology (9), Retail & E-Commerce (5) and Manufacturing (3), with about 990 GB reported exfiltrated across 25 victims. The earliest estimated attack date is 2026-07-06 and the earliest discovery is 2026-09-03. The group runs a Tor leak blog (Apache 2.4.68 on Debian) with an average 17-day delay between attack and listing. Other recent victims include Living Word Schools (2026-11-09), ZipAI (2026-11-05), System Soft (2026-10-31), JHAMF Group (2026-10-31), polisee Inc (2026-10-17) and Data-Core Systems (2026-10-16). Ransomware.live also publishes a Tox ID and two Bitcoin wallets for the group.

Initial access for this victim is unknown. SOCRadar reports that Vexy operators reportedly buy credentials from underground markets, often harvested by infostealers. Security Arsenal (medium confidence, based on leak-site monitoring) assesses likely edge-appliance or RDP exploitation, credential stuffing and phishing, followed by lateral movement via RDP/WMI/PsExec, staging with archive tools, exfiltration, and encryption with shadow-copy deletion. Those behaviours are assessed from comparable groups and are NOT confirmed as Vexy-specific; Security Arsenal's candidate CVEs are likewise unconfirmed and are not listed on this record. Ransom note, file extension and encryption algorithm are not publicly documented. Whether the victim's systems were encrypted is not stated; the claim only reports data theft.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021 Remote Services

Execution

T1047 Windows Management Instrumentation; T1569.002 System Services: Service Execution

Initial Access

T1078 Valid Accounts

Impact

T1490 Inhibit System Recovery; T1657 Financial Theft

Collection

T1560.001 Archive Collected Data: Archive via Utility

Exfiltration

T1567 Exfiltration Over Web Service

Remediation

Immediate actions

• Reset credentials and invalidate sessions and cookies for all accounts tied to albion-online-data.com infrastructure, admin panels and API keys
• Hunt for infostealer-sourced credentials in use against VPN, RDP, remote-access and admin portals
• Block outbound transfers of large archives to unknown destinations and review egress logs for ~16 GB of staged or transferred data around 2026-11-01 to 2026-11-07
• Alert on shadow-copy deletion (vssadmin, wmic shadowcopy, diskshadow, bcdedit) and bulk service termination

Workarounds

• Restrict RDP and remote-management services to VPN or allow-listed sources
• Rotate API tokens and secrets stored on affected hosts
• Treat Vexy-listed Tox ID and Bitcoin wallets as blocklist and sanctions-screening indicators

Longer-term hardening

• Enforce phishing-resistant MFA on all remote access and administrative accounts
• Monitor for infostealer exposure of company domains and employee accounts
• Maintain offline, immutable backups and test restores
• Segment API, database and build infrastructure from administrative networks
• Patch and restrict exposure of internet-facing edge and remote-access appliances

Affected and fixed versions

• Albion Online Data Project — albion-online-data.com community market-data platform, APIs and data feeds

Timeline

• 2026-07-06 Earliest estimated Vexy Ransomware attack date per Ransomware.live (Palsana Enviro victim).
• 2026-09-03 Earliest Vexy leak-site discovery recorded by Ransomware.live; Security Arsenal reported the group's first batch of victims on 2026-09-04.
• 2026-10-13 SOCRadar reports Vexy Ransomware claim against Brazilian media company Guarufilme.
• 2026-10-16 Vexy claims US IT consultancy Data-Core Systems and threatens a full leak unless a representative makes contact.
• 2026-10-31 Vexy lists System Soft (Bulgaria) and JHAMF Group (Bangladesh).
• 2026-11-05 Vexy lists ZipAI (Vietnam); the group's most recent listing before the Albion claim.
• 2026-11-07 Estimated attack date against Albion Online Data Project; 16 GB reportedly exfiltrated.
• 2026-11-09 Albion Online Data Project listed as a Vexy victim on Ransomware.live (discovered 19:08 UTC); no leak links published. Living Word Schools listed the same day.

Sources cited

• Ransomware.live victim entry: Albion Online Data Project (Vexy Ransomware) ransomware.live · Research · 2026-11-09
• Ransomware.live group profile: Vexy Ransomware ransomware.live · Research · 2026-11-09
• SOCRadar: Vexy Ransomware claims Guarufilme socradar.io · Research · 2026-10-13
• Security Arsenal: Vexy Ransomware Gang - 5 New Victims in 4 Days securityarsenal.com · Blog · 2026-09-04
• Dexpose: Vexy Ransomware Strikes Data-Core Systems dexpose.io · News · 2026-10-16
• Dexpose: Vexy Ransomware Strikes Sancity Soft Touch dexpose.io · News · 2026-09-04

More in ransomware

• Vanderbilt University hit in BYOD ransomware attack, data theft claimed
• Vexy Ransomware lists Living Word Schools (US education) as victim
• Halcyon August 2026 Ransomware Report: 10 of Top 15 Families New vs. July; Manufacturing Top Target
• Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing
• BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments

Related coverage of this activity

• Vexy juice manufacturer ransomware
• Vexy Ransomware Guarufilme
• Vexy Ransomware Data-Core breach
• Vexy ransomware leak listing

More from Vexy Ransomware

• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated
• Vexy Ransomware claims JHAMF Group (IT services) - 110 GB exfiltrated
• Vexy Ransomware claims polisee Inc (AI policy intelligence platform) as victim
• Vexy Ransomware claims Enchanted Fine Jewellery (India, Retail & E-Commerce) - 34.88 GB exfiltrated
• Vexy Ransomware Claims Data-Extortion Attack on Majani Insurance Brokers (Kenya)
• Vexy Ransomware Claims Quy Nhon University (Vietnam) — New Group, 50GB Exfiltrated