Skip to navigation

Threat reportRansomwareTL-2026-5580

Vexy Ransomware lists Living Word Schools (US education) as victim

mediumACTIVE

Ransomware.live lists Living Word Schools (livingwordschools.org, US, education) as a victim of the Vexy Ransomware group, discovered 2026-11-09 with an estimated attack date of 2026-11-07 and 120 MB recorded as exfiltrated. No claim text, CVE or IOCs are shown in the listing; the claim is unverified.

Key facts

IdentifiersTL-2026-5580
SeverityMEDIUM
First disclosed
Affected productsLiving Word Schools livingwordschools.org online platform (application portal and login facilities)
AttributionVexy Ransomware (low confidence)
MalwareVexy Ransomware
Tools7-Zip, ConnectWise ScreenConnect, PSEXEC, WinRAR
MITRE ATT&CK techniquesT1021 Remote Services, T1047 Windows Management Instrumentation, T1078 Valid Accounts, T1133 External Remote Services, T1190 Exploit Public-Facing Application, T1490 Inhibit System Recovery, T1560.001 Archive via Utility, T1569.002 Service Execution, T1657 Financial Theft
MotivationFINANCIAL
Target sectorseducation, technology, retail, manufacturing
Target regionsNorth America
Detection rules9 (1 shown free)
Sources6 cited sources

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5580 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Vexy Ransomware (TL-2026-5580) — PsExec PSEXESVC Service Installation / Execution

Detects installation of the PSEXESVC service or execution of PSEXESVC.exe, the artifact left on a target by PsExec remote execution. PsExec lateral movement is part of the assessed Vexy Ransomware playbook (SecurityArsenal, medium confidence; not observed for this victim).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1569.002, T1021
  • Data sources: windows_system, sysmon, microsoft_defender_for_endpoint
  • Severity: high
  • Confidence: high

Splunk SPL

(index=wineventlog sourcetype="WinEventLog:System" EventCode=7045 (Service_Name="PSEXESVC" OR Service_File_Name="*PSEXESVC.exe*")) OR (index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\PSEXESVC.exe" OR ParentImage="*\\PSEXESVC.exe")) | eval service_file=coalesce(Service_File_Name, Image), account=coalesce(Service_Account, User) | stats count min(_time) as first_seen values(service_file) as service_file values(account) as account values(CommandLine) as child_commands by host | eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S")

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "PSEXESVC.exe" or InitiatingProcessFileName =~ "PSEXESVC.exe"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName

Sigma

title: PsExec PSEXESVC Service Execution on Target Host
id: c4d85a19-6e2b-47f0-9a3c-1b7e5d0f8c33
status: experimental
description: Detects execution of PSEXESVC.exe or processes spawned by it, the remote service artifact of PsExec lateral movement.
references:
    - https://www.ransomware.live/group/vexy
    - https://securityarsenal.com/blog/vexy-ransomware-gang-5-new-victims-in-4-days-india-and-latam-campaign-sector-analysis-and-detection-rules
author: Threadlinqs Team
date: 2026-11-09
tags:
    - attack.lateral-movement
    - attack.execution
    - attack.t1021
    - attack.t1569.002
    - attack.s0029
logsource:
    category: process_creation
    product: windows
detection:
    selection_image:
        Image|endswith: '\PSEXESVC.exe'
    selection_parent:
        ParentImage|endswith: '\PSEXESVC.exe'
    condition: 1 of selection_*
falsepositives:
    - Administrators legitimately using PsExec for remote management
level: high

Known false positives:

  • IT administrators using Sysinternals PsExec for sanctioned remote management
  • Patch or inventory tooling that wraps PsExec

Tuning notes: Allow-list admin jump hosts and accounts that legitimately use PsExec. Renamed PsExec service names are not covered; pair with the ADMIN$ write detection (SIG-003) for coverage of renamed binaries.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Vexy Ransomware (TL-2026-5580) — External RDP Logon After Repeated Failures (Valid Accounts) · unlock with TL Creds
  • Vexy Ransomware (TL-2026-5580) — 7-Zip / WinRAR Password-Protected or Split Archiving (Data Staging) · unlock with TL Creds
  • Vexy Ransomware (TL-2026-5580) — WMI Remote Process Creation (WmiPrvSE Shell / wmic /node) · unlock with TL Creds
  • Vexy Ransomware (TL-2026-5580) — Recovery Disablement via bcdedit and wbadmin · unlock with TL Creds
  • Vexy Ransomware (TL-2026-5580) — robocopy /MIR Bulk Copy to Nonstandard or UNC Path (Data Staging) · unlock with TL Creds
  • Vexy Ransomware (TL-2026-5580) — Executable Written to ADMIN$ Share (PsExec-style Lateral Movement) · unlock with TL Creds
  • Vexy Ransomware (TL-2026-5580) — ConnectWise ScreenConnect Client Spawning Command Shell · unlock with TL Creds
  • Vexy Ransomware (TL-2026-5580) — Shadow Copy Deletion via vssadmin, wmic, diskshadow or PowerShell · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5580.

Sample indicators (1 of 9)

  • Domain: livingwordschools[.]org

Defanged, TLP:CLEAR. Full set of 9 indicators: unlock with TL Creds.

9 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Ransomware.live recorded Living Word Schools, a US education organization (livingwordschools.org) whose online platform includes student and school administration functionality, an application portal and login facilities, as a victim of the Vexy Ransomware group. The listing was discovered 2026-11-09 19:08 UTC with an estimated attack date of 2026-11-07, and 120 MB of data is recorded as exfiltrated. The listing shows no claim text, ransom note, screenshots or onion URL. Listings on leak sites are group claims and have not been confirmed by the victim or a vendor report.

Exposure enrichment on the listing shows HudsonRock infostealer data of 4 compromised users, 0 compromised employees, 0 third-party employee credentials and 3 exposed credential URLs indexed; ParanoidLab shows 0 passwords and 3 cookies (0 critical). The listing therefore does not establish how access was obtained. One third-party analysis of the group (SecurityArsenal) states that operators obtain credentials from underground marketplaces, often harvested by infostealers, but this is a general statement about the group, not about this victim.

Vexy Ransomware is tracked by ransomware.live as active, with 28 victims across 15 countries (top countries India 6, United States 5, Brazil 3), about 1,006.4 GB of reported exfiltration across 27 of 28 victims, earliest estimated attack 2026-07-06 and first discovery 2026-09-03. Infostealer data was found for 64.3% of victims with a domain. Its Tor blog (Apache 2.4.68 on Debian) was unavailable when last visited on 2026-11-09. Ransomware.live also lists two Bitcoin wallets and one Tox ID for the group, but the values are not shown in the fetched page content and are not recorded here. The group is described as using double extortion with a closed or semi-private RaaS model and an assessed 5-14 day dwell time and $150K-$2M demand range (SecurityArsenal estimates, medium confidence). The assessed playbook is edge or RMM exploitation or valid credentials, Windows privilege escalation, RDP/WMI/PsExec lateral movement, staging and archiving with 7z/WinRAR, exfiltration, then encryption with shadow copy deletion; SecurityArsenal states encryption and VSS deletion behavior is an assumption based on comparable groups, not an observation. Candidate CVEs named by that analysis are not evidenced for this victim and are not listed. Severity MEDIUM is an analyst judgment.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021 Remote Services

Execution

T1047 Windows Management Instrumentation; T1569.002 Service Execution

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Impact

T1490 Inhibit System Recovery; T1657 Financial Theft

Collection

T1560.001 Archive via Utility

Remediation

Immediate actions

  • Reset credentials and invalidate sessions for the student and administration portal accounts; 4 infostealer-compromised users and 3 exposed cookies are indexed for the domain
  • Review authentication logs for the application portal and login facilities from 2026-10-24 onward for anomalous access
  • Confirm with the organization whether a breach occurred and what the 120 MB of data contains before notifying affected parties

Workarounds

  • Restrict RDP and remote management tools such as ScreenConnect to allow-listed sources
  • Audit internet-facing edge appliances for unpatched vulnerabilities

Longer-term hardening

  • Enforce MFA on all remote access, VPN and portal logins
  • Monitor infostealer-exposure feeds for organization domains
  • Retain offline, tested backups and protect against shadow copy deletion (vssadmin, wmic, diskshadow, bcdedit)
  • Alert on PsExec service creation (PSEXESVC), WMI remote process creation and bulk archiving with 7z or WinRAR

Affected and fixed versions

  • Living Word Schools — livingwordschools.org online platform (application portal and login facilities)

Timeline

  • Earliest estimated attack date attributed to Vexy Ransomware on its ransomware.live group profile
  • First Vexy Ransomware victim discovery date recorded by ransomware.live
  • SecurityArsenal reports five Vexy victims posted 2026-09-02 to 2026-09-04 (Brazil, Ecuador, India) and describes a double-extortion, closed/semi-private RaaS operation
  • polisee Inc listed as a Vexy Ransomware victim on ransomware.live
  • System Soft and JHAMF Group listed as Vexy Ransomware victims
  • ZipAI listed as a Vexy Ransomware victim
  • Estimated attack date on Living Word Schools per ransomware.live
  • Vexy Tor blog (Apache 2.4.68 on Debian) last visited by ransomware.live at 19:22 UTC and marked unavailable
  • Living Word Schools (locked-ioc-2) discovered on the Vexy Ransomware leak site by ransomware.live at 19:08 UTC; 120 MB exfiltrated recorded; Albion Online Data Project listed the same day

Sources cited

More from Vexy Ransomware

Drafted by the Threadlinqs research pipeline from 6 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats