# Vexy Ransomware claims Franc-Oil (Nigeria, Energy & Utilities) - 200 MB exfiltration claimed

> Ransomware.live lists Franc-Oil (franc-oiloffshore.com.ng), a Nigerian offshore and marine services company, as a victim of the Vexy Ransomware group, which claims 200 MB of exfiltrated data. The claim is unverified, and the initial access vector and malware details are not public.

- **Published:** 2026-11-13T00:02:17Z
- **Last reviewed:** 2026-11-13T00:02:17Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5905
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5905.png
- **ID:** TL-2026-5905
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Vexy Ransomware
- **Detections:** 9 (1 shown free below) · **IOCs:** 11 (2 shown free below)

## Description

On 2026-11-12 (23:19 UTC) Ransomware.live recorded a leak-site claim by the Vexy Ransomware group against Franc-Oil, a Nigerian offshore and marine services company. Its services include vessel chartering, marine logistics, dredging, crew management, offshore construction and oilfield support. The estimated attack date is 2026-11-12 and the claimed exfiltrated volume is 200 MB. The aggregator entry gives no ransom note, malware samples, hashes or intrusion details, and the claim has not been independently confirmed by the victim or a third party. A ParanoidLab exposure check on the victim domain found 0 exposed passwords and 0 cookies.

Vexy Ransomware is an emerging double-extortion group. Ransomware.live shows it as active, with an estimated earliest attack of 2026-07-06 and a first listing discovered 2026-09-03. As of 2026-11-12 the page lists 31 victims, 30 of them with data exfiltration totalling about 1008 GB, across 17 countries. The top countries are India (6), United States (5), Brazil (4), Viet Nam (2) and Nigeria (1). The top sectors are Technology (11), Retail & E-Commerce (5), Manufacturing (3) and Energy & Utilities (2). The average delay from attack to listing is about 12 days, and the group publishes on a Tor blog. Franc-Oil is the only Nigerian victim on that page.

Operating details come from vendor commentary and are assessed, not confirmed. SecurityArsenal describes a closed or semi-private RaaS model with a small operator core, double extortion with a countdown and sample releases for non-payers, and no observed triple extortion. SOCRadar suggests the operators buy credentials harvested by infostealers on underground markets. SecurityArsenal assesses likely initial access through edge appliances, exposed RDP with credential stuffing, or phishing, and a playbook of lateral movement via PsExec/WMI, data staging and archiving, then encryption with shadow-copy deletion (vssadmin, wmic, diskshadow, bcdedit). These TTPs are inferred from rule tags and comparable groups, not from a published Vexy incident report. No victim-specific forensic evidence exists for Franc-Oil.

Defenders should treat the listing as an unverified extortion claim. Exposure of Franc-Oil data should be assessed with the victim, and the behavioral indicators below used for hunting.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1133 External Remote Services
- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1047 Windows Management Instrumentation
- T1569.002 System Services: Service Execution
- T1021 Remote Services
- T1560.001 Archive Collected Data: Archive via Utility
- T1490 Inhibit System Recovery
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Vexy Ransomware — PsExec Service Execution and PSEXESVC Named Pipes (Lateral Movement)** (`TL-2026-5905-SPL-003`)

Detects PSEXESVC service installation (System EventCode 7045) and PSEXESVC named pipes (Sysmon EventCodes 17 and 18), lateral movement and service execution tooling assessed for Vexy Ransomware (TL-2026-5905, T1569.002, T1021). PsExec use is inferred by SecurityArsenal, not confirmed in a published Vexy incident.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1569.002, T1021, T1021.002
- **Data sources:** windows_system, sysmon, WinEventLog:System 7045
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
(index=wineventlog sourcetype="WinEventLog:System" EventCode=7045 (Service_Name="PSEXESVC" OR Service_File_Name="*PSEXESVC.exe")) OR (index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=17 OR EventCode=18) PipeName="*PSEXESVC*")
| eval signal=if(EventCode=7045, "service_install", "named_pipe")
| stats count min(_time) as first_seen max(_time) as last_seen values(signal) as signals values(Service_File_Name) as service_path values(PipeName) as pipes by host
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ 'PSEXESVC.exe'
    or (FileName in~ ('psexec.exe', 'psexec64.exe') and ProcessCommandLine contains @'\\')
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
```

### Sigma

```yaml
title: Vexy Ransomware - PsExec Service Installation (PSEXESVC)
id: 9a4f6b21-3d7e-4c85-b0a2-1f8e5d7c9a21
status: experimental
description: Detects installation of the PSEXESVC service used by PsExec for remote service execution, assessed lateral movement for Vexy Ransomware (TL-2026-5905).
references:
    - https://www.ransomware.live/group/Vexy%20Ransomware
    - https://securityarsenal.com/blog/vexy-ransomware-gang-5-new-victims-in-4-days-india-and-latam-campaign-sector-analysis-and-detection-rules
author: Threadlinqs Team
date: 2026/11/12
tags:
    - attack.lateral-movement
    - attack.execution
    - attack.t1569.002
    - attack.t1021.002
    - attack.tool.psexec
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7045
    selection_psexec:
        - ServiceName: 'PSEXESVC'
        - ImagePath|endswith: '\PSEXESVC.exe'
    condition: selection and selection_psexec
falsepositives:
    - Administrators using PsExec for approved remote management
    - IT automation or software deployment tooling that bundles PsExec
level: high

```

**Known false positives:**

- Approved administrative use of PsExec
- Deployment and patching tools that wrap PsExec

**Tuning notes:** Allowlist source admin hosts, jump servers and accounts, and alert on any PsExec use outside a documented administrative group. Sysmon named-pipe events (EventCodes 17 and 18) must be enabled in your Sysmon configuration.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Vexy Ransomware — Office or Mail Client Spawning Script Interpreters (Phishing Execution) (locked: unlock with TL Creds)
- Vexy Ransomware — Bulk Archiving and Robocopy Mirror Data Staging (Exfiltration Prep) (locked: unlock with TL Creds)
- Vexy Ransomware — WMI Remote Process Creation (Lateral Movement) (locked: unlock with TL Creds)
- Vexy Ransomware — Web or Edge Server Process Spawning Shell (Public-Facing Application Exploitation) (locked: unlock with TL Creds)
- Vexy Ransomware — Backup Catalog Deletion and Boot Recovery Disabled (wbadmin/bcdedit) (locked: unlock with TL Creds)
- Vexy Ransomware — DNS or Network Resolution of the Vexy Tor Leak Site (.onion) (locked: unlock with TL Creds)
- Vexy Ransomware — Credential Stuffing Followed by Successful Remote Logon (Initial Access) (locked: unlock with TL Creds)
- Vexy Ransomware — Shadow Copy Deletion and Recovery Inhibition (vssadmin/wmic/diskshadow/bcdedit) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 11)

Defanged, TLP:CLEAR.

- Domain: `vexytsr3chimdz6siwaqi2lvxxwfkxvffkpwyanr2llequ2hkm56jvqd[.]onion`
- Domain: `franc-oiloffshore[.]com[.]ng`

Full set of 11 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Ransomware.live victim entry: Franc-Oil / Vexy Ransomware](https://www.ransomware.live/id/RnJhbmMtT2lsQFZleHkgUmFuc29td2FyZQ)
- [Ransomware.live group profile: Vexy Ransomware](https://www.ransomware.live/group/Vexy%20Ransomware)
- [SecurityArsenal: Vexy Ransomware Gang - 5 New Victims in 4 Days, India and LATAM Campaign, Detection Rules](https://securityarsenal.com/blog/vexy-ransomware-gang-5-new-victims-in-4-days-india-and-latam-campaign-sector-analysis-and-detection-rules)
- [WatchGuard ransomware tracker: Vexy Ransomware](https://www.watchguard.com/node/122426)
- [SOCRadar: Groupe Proxitel / Vexy Ransomware](https://socradar.io/data-breach/groupe-proxitel-vexy-ransomware-2026/)
- [SOCRadar Ransomware Intelligence: Vexy Ransomware group](https://socradar.io/free-tools/ransomware-intelligence/groups/vexy-ransomware)
- [SOCRadar: Vexy Ransomware claims Guarufilme](https://socradar.io/data-breach/vexy-ransomware-claims-guarufilme-october-13-2026/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5905