# Vexy Ransomware lists Living Word Schools (US education) as victim

> Ransomware.live lists Living Word Schools (livingwordschools.org, US, education) as a victim of the Vexy Ransomware group, discovered 2026-11-09 with an estimated attack date of 2026-11-07 and 120 MB recorded as exfiltrated. No claim text, CVE or IOCs are shown in the listing; the claim is unverified.

- **Published:** 2026-11-09T19:43:01Z
- **Last reviewed:** 2026-11-09T19:43:01Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5580
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5580.png
- **ID:** TL-2026-5580
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Vexy Ransomware
- **Detections:** 9 (1 shown free below) · **IOCs:** 9 (1 shown free below)

## Description

Ransomware.live recorded Living Word Schools, a US education organization (livingwordschools.org) whose online platform includes student and school administration functionality, an application portal and login facilities, as a victim of the Vexy Ransomware group. The listing was discovered 2026-11-09 19:08 UTC with an estimated attack date of 2026-11-07, and 120 MB of data is recorded as exfiltrated. The listing shows no claim text, ransom note, screenshots or onion URL. Listings on leak sites are group claims and have not been confirmed by the victim or a vendor report.

Exposure enrichment on the listing shows HudsonRock infostealer data of 4 compromised users, 0 compromised employees, 0 third-party employee credentials and 3 exposed credential URLs indexed; ParanoidLab shows 0 passwords and 3 cookies (0 critical). The listing therefore does not establish how access was obtained. One third-party analysis of the group (SecurityArsenal) states that operators obtain credentials from underground marketplaces, often harvested by infostealers, but this is a general statement about the group, not about this victim.

Vexy Ransomware is tracked by ransomware.live as active, with 28 victims across 15 countries (top countries India 6, United States 5, Brazil 3), about 1,006.4 GB of reported exfiltration across 27 of 28 victims, earliest estimated attack 2026-07-06 and first discovery 2026-09-03. Infostealer data was found for 64.3% of victims with a domain. Its Tor blog (Apache 2.4.68 on Debian) was unavailable when last visited on 2026-11-09. Ransomware.live also lists two Bitcoin wallets and one Tox ID for the group, but the values are not shown in the fetched page content and are not recorded here. The group is described as using double extortion with a closed or semi-private RaaS model and an assessed 5-14 day dwell time and $150K-$2M demand range (SecurityArsenal estimates, medium confidence). The assessed playbook is edge or RMM exploitation or valid credentials, Windows privilege escalation, RDP/WMI/PsExec lateral movement, staging and archiving with 7z/WinRAR, exfiltration, then encryption with shadow copy deletion; SecurityArsenal states encryption and VSS deletion behavior is an assumption based on comparable groups, not an observation. Candidate CVEs named by that analysis are not evidenced for this victim and are not listed. Severity MEDIUM is an analyst judgment.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1047 Windows Management Instrumentation
- T1569.002 Service Execution
- T1021 Remote Services
- T1560.001 Archive via Utility
- T1490 Inhibit System Recovery
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Vexy Ransomware (TL-2026-5580) — PsExec PSEXESVC Service Installation / Execution** (`TL-2026-5580-SPL-003`)

Detects installation of the PSEXESVC service or execution of PSEXESVC.exe, the artifact left on a target by PsExec remote execution. PsExec lateral movement is part of the assessed Vexy Ransomware playbook (SecurityArsenal, medium confidence; not observed for this victim).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1569.002, T1021
- **Data sources:** windows_system, sysmon, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
(index=wineventlog sourcetype="WinEventLog:System" EventCode=7045 (Service_Name="PSEXESVC" OR Service_File_Name="*PSEXESVC.exe*")) OR (index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\PSEXESVC.exe" OR ParentImage="*\\PSEXESVC.exe")) | eval service_file=coalesce(Service_File_Name, Image), account=coalesce(Service_Account, User) | stats count min(_time) as first_seen values(service_file) as service_file values(account) as account values(CommandLine) as child_commands by host | eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S")
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "PSEXESVC.exe" or InitiatingProcessFileName =~ "PSEXESVC.exe"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName
```

### Sigma

```yaml
title: PsExec PSEXESVC Service Execution on Target Host
id: c4d85a19-6e2b-47f0-9a3c-1b7e5d0f8c33
status: experimental
description: Detects execution of PSEXESVC.exe or processes spawned by it, the remote service artifact of PsExec lateral movement.
references:
    - https://www.ransomware.live/group/vexy
    - https://securityarsenal.com/blog/vexy-ransomware-gang-5-new-victims-in-4-days-india-and-latam-campaign-sector-analysis-and-detection-rules
author: Threadlinqs Team
date: 2026-11-09
tags:
    - attack.lateral-movement
    - attack.execution
    - attack.t1021
    - attack.t1569.002
    - attack.s0029
logsource:
    category: process_creation
    product: windows
detection:
    selection_image:
        Image|endswith: '\PSEXESVC.exe'
    selection_parent:
        ParentImage|endswith: '\PSEXESVC.exe'
    condition: 1 of selection_*
falsepositives:
    - Administrators legitimately using PsExec for remote management
level: high

```

**Known false positives:**

- IT administrators using Sysinternals PsExec for sanctioned remote management
- Patch or inventory tooling that wraps PsExec

**Tuning notes:** Allow-list admin jump hosts and accounts that legitimately use PsExec. Renamed PsExec service names are not covered; pair with the ADMIN$ write detection (SIG-003) for coverage of renamed binaries.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Vexy Ransomware (TL-2026-5580) — External RDP Logon After Repeated Failures (Valid Accounts) (locked: unlock with TL Creds)
- Vexy Ransomware (TL-2026-5580) — 7-Zip / WinRAR Password-Protected or Split Archiving (Data Staging) (locked: unlock with TL Creds)
- Vexy Ransomware (TL-2026-5580) — WMI Remote Process Creation (WmiPrvSE Shell / wmic /node) (locked: unlock with TL Creds)
- Vexy Ransomware (TL-2026-5580) — Recovery Disablement via bcdedit and wbadmin (locked: unlock with TL Creds)
- Vexy Ransomware (TL-2026-5580) — robocopy /MIR Bulk Copy to Nonstandard or UNC Path (Data Staging) (locked: unlock with TL Creds)
- Vexy Ransomware (TL-2026-5580) — Executable Written to ADMIN$ Share (PsExec-style Lateral Movement) (locked: unlock with TL Creds)
- Vexy Ransomware (TL-2026-5580) — ConnectWise ScreenConnect Client Spawning Command Shell (locked: unlock with TL Creds)
- Vexy Ransomware (TL-2026-5580) — Shadow Copy Deletion via vssadmin, wmic, diskshadow or PowerShell (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 9)

Defanged, TLP:CLEAR.

- Domain: `livingwordschools[.]org`

Full set of 9 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Ransomware.live victim listing: Living Word Schools / Vexy Ransomware](https://www.ransomware.live/id/TGl2aW5nIFdvcmQgU2Nob29sc0BWZXh5IFJhbnNvbXdhcmU)
- [Ransomware.live group profile: Vexy Ransomware](https://www.ransomware.live/group/vexy)
- [SecurityArsenal: Vexy Ransomware Gang - 5 New Victims in 4 Days, India and LATAM Campaign](https://securityarsenal.com/blog/vexy-ransomware-gang-5-new-victims-in-4-days-india-and-latam-campaign-sector-analysis-and-detection-rules)
- [SecurityArsenal ransomware tracker: Vexy Ransomware - Palsana Enviro (PEPL)](https://securityarsenal.com/darkside/ransomware-tracker/vexy-ransomware--palsana-enviro-pepl)
- [SOCRadar: Vexy Ransomware claims Guarufilme](https://socradar.io/data-breach/vexy-ransomware-claims-guarufilme-october-13-2026/)
- [Dexpose: Vexy Ransomware Strikes Data-Core Systems](https://www.dexpose.io/vexy-ransomware-strikes-data-core-systems/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5580