Threat reportRansomwareTL-2026-5905
Vexy Ransomware claims Franc-Oil (Nigeria, Energy & Utilities) - 200 MB exfiltration claimed
Ransomware.live lists Franc-Oil (franc-oiloffshore.com.ng), a Nigerian offshore and marine services company, as a victim of the Vexy Ransomware group, which claims 200 MB of exfiltrated data. The claim is unverified, and the initial access vector and malware details are not public.
Key facts
| Identifiers | TL-2026-5905 |
|---|---|
| Severity | MEDIUM |
| First disclosed | |
| Affected products | Franc-Oil Franc-Oil offshore and marine services corporate environment (franc-oiloffshore.com.ng) |
| Attribution | Vexy Ransomware (low confidence) |
| Malware | Dataleak, Vexy Ransomware |
| Tools | 7-Zip, PSEXEC, WinRAR, bcdedit, diskshadow, vssadmin, wmic |
| MITRE ATT&CK techniques | T1021 Remote Services, T1047 Windows Management Instrumentation, T1078 Valid Accounts, T1133 External Remote Services, T1190 Exploit Public-Facing Application, T1490 Inhibit System Recovery, T1560.001 Archive Collected Data: Archive via Utility, T1566 Phishing, T1569.002 System Services: Service Execution, T1657 Financial Theft |
| Motivation | FINANCIAL |
| Target sectors | energy, technology, retail, manufacturing, marine-logistics |
| Target regions | Africa, Asia, 005 - South America, North America, Europe |
| Detection rules | 9 (1 shown free) |
| Sources | 7 cited sources |
Detection coverage
As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5905 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: Vexy Ransomware — PsExec Service Execution and PSEXESVC Named Pipes (Lateral Movement)
Detects PSEXESVC service installation (System EventCode 7045) and PSEXESVC named pipes (Sysmon EventCodes 17 and 18), lateral movement and service execution tooling assessed for Vexy Ransomware (TL-2026-5905, T1569.002, T1021). PsExec use is inferred by SecurityArsenal, not confirmed in a published Vexy incident.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1569.002, T1021, T1021.002
- Data sources: windows_system, sysmon, WinEventLog:System 7045
- Severity: high
- Confidence: high
Splunk SPL
(index=wineventlog sourcetype="WinEventLog:System" EventCode=7045 (Service_Name="PSEXESVC" OR Service_File_Name="*PSEXESVC.exe")) OR (index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=17 OR EventCode=18) PipeName="*PSEXESVC*")
| eval signal=if(EventCode=7045, "service_install", "named_pipe")
| stats count min(_time) as first_seen max(_time) as last_seen values(signal) as signals values(Service_File_Name) as service_path values(PipeName) as pipes by host
| convert ctime(first_seen) ctime(last_seen)Microsoft KQL
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ 'PSEXESVC.exe'
or (FileName in~ ('psexec.exe', 'psexec64.exe') and ProcessCommandLine contains @'\\')
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLineSigma
title: Vexy Ransomware - PsExec Service Installation (PSEXESVC)
id: 9a4f6b21-3d7e-4c85-b0a2-1f8e5d7c9a21
status: experimental
description: Detects installation of the PSEXESVC service used by PsExec for remote service execution, assessed lateral movement for Vexy Ransomware (TL-2026-5905).
references:
- https://www.ransomware.live/group/Vexy%20Ransomware
- https://securityarsenal.com/blog/vexy-ransomware-gang-5-new-victims-in-4-days-india-and-latam-campaign-sector-analysis-and-detection-rules
author: Threadlinqs Team
date: 2026/11/12
tags:
- attack.lateral-movement
- attack.execution
- attack.t1569.002
- attack.t1021.002
- attack.tool.psexec
logsource:
product: windows
service: system
detection:
selection:
EventID: 7045
selection_psexec:
- ServiceName: 'PSEXESVC'
- ImagePath|endswith: '\PSEXESVC.exe'
condition: selection and selection_psexec
falsepositives:
- Administrators using PsExec for approved remote management
- IT automation or software deployment tooling that bundles PsExec
level: high
Known false positives:
- Approved administrative use of PsExec
- Deployment and patching tools that wrap PsExec
Tuning notes: Allowlist source admin hosts, jump servers and accounts, and alert on any PsExec use outside a documented administrative group. Sysmon named-pipe events (EventCodes 17 and 18) must be enabled in your Sysmon configuration.
- Vexy Ransomware — Office or Mail Client Spawning Script Interpreters (Phishing Execution) · unlock with TL Creds
- Vexy Ransomware — Bulk Archiving and Robocopy Mirror Data Staging (Exfiltration Prep) · unlock with TL Creds
- Vexy Ransomware — WMI Remote Process Creation (Lateral Movement) · unlock with TL Creds
- Vexy Ransomware — Web or Edge Server Process Spawning Shell (Public-Facing Application Exploitation) · unlock with TL Creds
- Vexy Ransomware — Backup Catalog Deletion and Boot Recovery Disabled (wbadmin/bcdedit) · unlock with TL Creds
- Vexy Ransomware — DNS or Network Resolution of the Vexy Tor Leak Site (.onion) · unlock with TL Creds
- Vexy Ransomware — Credential Stuffing Followed by Successful Remote Logon (Initial Access) · unlock with TL Creds
- Vexy Ransomware — Shadow Copy Deletion and Recovery Inhibition (vssadmin/wmic/diskshadow/bcdedit) · unlock with TL Creds
Indicators of compromise
As of 2026-11-13, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-5905.
Sample indicators (2 of 11)
- Domain:
vexytsr3chimdz6siwaqi2lvxxwfkxvffkpwyanr2llequ2hkm56jvqd[.]onion - Domain:
franc-oiloffshore[.]com[.]ng
Defanged, TLP:CLEAR. Full set of 11 indicators: unlock with TL Creds.
Technical analysis
On 2026-11-12 (23:19 UTC) Ransomware.live recorded a leak-site claim by the Vexy Ransomware group against Franc-Oil, a Nigerian offshore and marine services company. Its services include vessel chartering, marine logistics, dredging, crew management, offshore construction and oilfield support. The estimated attack date is 2026-11-12 and the claimed exfiltrated volume is 200 MB. The aggregator entry gives no ransom note, malware samples, hashes or intrusion details, and the claim has not been independently confirmed by the victim or a third party. A ParanoidLab exposure check on the victim domain found 0 exposed passwords and 0 cookies.
Vexy Ransomware is an emerging double-extortion group. Ransomware.live shows it as active, with an estimated earliest attack of 2026-07-06 and a first listing discovered 2026-09-03. As of 2026-11-12 the page lists 31 victims, 30 of them with data exfiltration totalling about 1008 GB, across 17 countries. The top countries are India (6), United States (5), Brazil (4), Viet Nam (2) and Nigeria (1). The top sectors are Technology (11), Retail & E-Commerce (5), Manufacturing (3) and Energy & Utilities (2). The average delay from attack to listing is about 12 days, and the group publishes on a Tor blog. Franc-Oil is the only Nigerian victim on that page.
Operating details come from vendor commentary and are assessed, not confirmed. SecurityArsenal describes a closed or semi-private RaaS model with a small operator core, double extortion with a countdown and sample releases for non-payers, and no observed triple extortion. SOCRadar suggests the operators buy credentials harvested by infostealers on underground markets. SecurityArsenal assesses likely initial access through edge appliances, exposed RDP with credential stuffing, or phishing, and a playbook of lateral movement via PsExec/WMI, data staging and archiving, then encryption with shadow-copy deletion (vssadmin, wmic, diskshadow, bcdedit). These TTPs are inferred from rule tags and comparable groups, not from a published Vexy incident report. No victim-specific forensic evidence exists for Franc-Oil.
Defenders should treat the listing as an unverified extortion claim. Exposure of Franc-Oil data should be assessed with the victim, and the behavioral indicators below used for hunting.
MITRE ATT&CK techniques by tactic:
Lateral Movement
Execution
T1047 Windows Management Instrumentation; T1569.002 System Services: Service Execution
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566 Phishing
Impact
T1490 Inhibit System Recovery; T1657 Financial Theft
Collection
Remediation
Immediate actions
- Hunt for shadow copy deletion (vssadmin delete shadows, wmic shadowcopy delete, diskshadow, bcdedit recoveryenabled no)
- Hunt for PsExec/PSEXESVC and WMI remote execution between servers and workstations
- Hunt for bulk archiving (7-Zip, WinRAR) and robocopy /MIR staging on file servers
- Review VPN, RDP and remote-management logs for credential-stuffing or anomalous logins
- Reset credentials that may appear in infostealer logs
Workarounds
- Restrict RDP exposure to the internet and require VPN with MFA
- Restrict PsExec and remote WMI to administrative jump hosts
Longer-term hardening
- Enforce MFA on all remote access and edge appliances
- Keep offline, immutable backups and test restores
- Patch internet-facing appliances and remote management tools promptly
- Monitor for infostealer-harvested credential exposure of corporate domains
- Segment OT/marine operations networks from corporate IT
Affected and fixed versions
- Franc-Oil — Franc-Oil offshore and marine services corporate environment (franc-oiloffshore.com.ng)
Timeline
- Ransomware.live lists 2026-07-06 as the (estimated) earliest Vexy Ransomware attack date.
- Vexy Ransomware posts early victims, including Engefitas (Brazil, manufacturing), as noted by WatchGuard and SecurityArsenal.
- Ransomware.live records its first Vexy discovery date, with McDonald's Ecuador among the early victims; WatchGuard lists first-seen as September 2026.
- Five victims in about 72 hours (Sep 2-4), mostly in India, as analyzed by SecurityArsenal.
- Vexy claims Groupe Proxitel (Timor-Leste telecom); SOCRadar notes the claim is unconfirmed.
- Ransomware.live discovers the Vexy leak-site listing for Franc-Oil (Nigeria, Energy & Utilities) at 23:19 UTC, claiming 200 MB exfiltrated. The group page shows 31 total victims and last activity the same day.
- Estimated attack date for the Franc-Oil intrusion per Ransomware.live (estimate; the group's average attack-to-listing delay is about 12 days).
Sources cited
- Ransomware.live victim entry: Franc-Oil / Vexy Ransomware ransomware.live · Research · 2026-11-12
- Ransomware.live group profile: Vexy Ransomware ransomware.live · Research · 2026-11-12
- WatchGuard ransomware tracker: Vexy Ransomware watchguard.com · Vendor report
- SOCRadar Ransomware Intelligence: Vexy Ransomware group socradar.io · Research
- SecurityArsenal: Vexy Ransomware Gang - 5 New Victims in 4 Days, India and LATAM Campaign, Detection Rules securityarsenal.com · Blog
- SOCRadar: Groupe Proxitel / Vexy Ransomware socradar.io · News · 2026-09-29
- SOCRadar: Vexy Ransomware claims Guarufilme socradar.io · News · 2026-10-13
More from Vexy Ransomware
- Vexy Ransomware lists Osiiminppal on leak site (100 MB claimed exfiltration)
- Vexy Ransomware lists Living Word Schools (US education) as victim
- Vexy Ransomware claims Albion Online Data Project (16 GB exfiltrated)
- Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated
- Vexy Ransomware claims JHAMF Group (IT services) - 110 GB exfiltrated
- Vexy Ransomware claims System Soft (Bulgaria) - 65 GB exfiltrated
Previous and next in ransomware
Drafted by the Threadlinqs research pipeline from 7 sources; published ; last updated —.
