Vexy Ransomware lists Osiiminppal on leak site (100 MB claimed exfiltration)

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5906 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Vexy Ransomware Initial Access — Brute-Force then Successful RDP/Network Logon from External IP (T1133)

Detects an external (non-RFC1918) source IP with 10+ failed Windows logons followed by at least one successful network/RDP logon against the same host in the same hour. Vexy Ransomware's initial access vector is unconfirmed (TL-2026-5906); public reporting lists only plausible vectors and remediation guidance centres on exposed RDP/VPN/RMM. This is a behaviour-first rule for External Remote Services (T1133) using valid or guessed accounts (T1078, T1110); it is not Vexy-specific.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1133, T1078, T1110
• Data sources: windows_security (index=wineventlog, sourcetype=WinEventLog:Security, EventCode 4624/4625), Microsoft Defender DeviceLogonEvents
• Severity: high
• Confidence: high

Splunk SPL

index=wineventlog sourcetype="WinEventLog:Security" (EventCode=4625 OR EventCode=4624) Logon_Type IN (3,10) earliest=-24h
| where isnotnull(src_ip) AND src_ip!="-" AND src_ip!="::1" AND src_ip!="127.0.0.1"
| where NOT (cidrmatch("10.0.0.0/8",src_ip) OR cidrmatch("172.16.0.0/12",src_ip) OR cidrmatch("192.168.0.0/16",src_ip))
| bin _time span=1h
| stats count(eval(EventCode=4625)) as failures count(eval(EventCode=4624)) as successes dc(user) as distinct_users values(user) as users by src_ip dest _time
| where failures>=10 AND successes>=1
| eval detection="TL-2026-5906-SPL-001", technique="T1133;T1078;T1110"
| table _time detection dest src_ip failures successes distinct_users users technique

Microsoft KQL

// TL-2026-5906 — external logon success after failure burst (T1133 / T1078 / T1110)
DeviceLogonEvents
| where Timestamp > ago(24h)
| where LogonType in ("RemoteInteractive", "Network") and isnotempty(RemoteIP)
| where ipv4_is_private(RemoteIP) == false
| summarize Failures=countif(ActionType == "LogonFailed"), Successes=countif(ActionType == "LogonSuccess"),
    DistinctUsers=dcount(AccountName), Users=make_set(AccountName, 10), FirstSeen=min(Timestamp)
    by RemoteIP, DeviceName, TimeBin=bin(Timestamp, 1h)
| where Failures >= 10 and Successes >= 1
| project TimeBin, DeviceName, RemoteIP, Failures, Successes, DistinctUsers, Users, FirstSeen

Sigma

title: Vexy Ransomware Initial Access - RDP Logon From Non-Private Source IP
id: 5b1f6c3e-7a42-4d58-9e0a-1c3b8f2d4a61
status: experimental
description: Detects successful RDP (logon type 10) logons from a non-private source IP, a common external remote services entry point (T1133) for ransomware operators. Initial access for Vexy Ransomware is unconfirmed.
references:
    - https://www.ransomware.live/id/T3NpaW1pbnBwYWxAVmV4eSBSYW5zb213YXJl
    - https://ransomware.live/group/Vexy%20Ransomware
    - https://securityarsenal.com/blog/vexy-ransomware-gang-5-new-victims-in-4-days-india-and-latam-campaign-sector-analysis-and-detection-rules
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.initial_access
    - attack.persistence
    - attack.t1133
    - attack.t1078
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4624
        LogonType: 10
    filter_private:
        IpAddress|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '127.0.0.0/8'
    filter_local:
        IpAddress:
            - '-'
            - '::1'
    condition: selection and not 1 of filter_*
falsepositives:
    - Administrators or vendors connecting over a sanctioned RDP gateway with a public egress IP
    - Cloud jump hosts or VPN concentrators NATing user traffic
level: medium

Known false positives:

• Legitimate administrators or vendors reaching RDP/SMB from a public egress IP
• Users repeatedly mistyping passwords before succeeding via a VPN/NAT address
• Vulnerability scanners or password-audit tools run from an external range

Tuning notes: Raise or lower the failures>=10 threshold per environment; allow-list known VPN/jump-host egress IPs and vendor ranges; restrict to internet-exposed servers via a lookup; ensure Windows Security 4624/4625 auditing is enabled and src_ip is CIM-normalised (Source_Network_Address).

• 🔒 Vexy Ransomware Exploitation — Public-Facing Web/App Service Spawning Shell or LOLBin (T1190) · unlock with TL Creds
• 🔒 Vexy Ransomware Impact — Mass File Rename / Extension Change by a Single Process (T1486) · unlock with TL Creds
• 🔒 Vexy Ransomware Exfiltration — Rclone/MEGA/SFTP Tooling and Onion or File-Share Network Connections (T1567.002) · unlock with TL Creds
• 🔒 Vexy Ransomware Access Persistence — Silent Install of Remote Management Tooling (T1133/T1219) · unlock with TL Creds
• 🔒 Vexy Ransomware Defense Evasion — Microsoft Defender Disabled or Excluded via PowerShell (T1562.001) · unlock with TL Creds
• 🔒 Vexy Ransomware C2/Extortion Channel — DNS Query for Onion Domains or Vexy Leak-Site Address (T1090.003) · unlock with TL Creds
• 🔒 Vexy Ransomware Impact — Shadow Copy Deletion and Recovery Inhibition (T1490) · unlock with TL Creds
• 🔒 Vexy Ransomware Exfiltration — Large Upload to File-Sharing Services, Tor Gateways or Vexy Infrastructure (T1567) · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-5906.

Sample indicators (3 of 16)

• IP address: 5.161.208[.]104
• Domain: vexytsr3chimdz6siwaqi2lvxxwfkxvffkpwyanr2llequ2hkm56jvqd[.]onion
• IP address: 46.21.148[.]130

Defanged, TLP:CLEAR. Full set of 16 indicators: unlock with TL Creds.

Technical analysis

On 2026-11-12 at 23:19 UTC, the ransomware.live tracker recorded a new victim post by the Vexy Ransomware group naming Osiiminppal (www.osiiminppal.com). The entry gives an estimated attack date of 2026-11-12, 100 MB of exfiltrated data, a country flag code of GL, and no sector (listed as Not Found). The ParanoidLab exposure report attached to the entry shows 0 exposed passwords and 0 cookies. No ransom note, encrypted-file extension, malware binary, hashes or initial access vector is published for this victim.

Vexy Ransomware is a double-extortion leak-site group. Per the ransomware.live group page (queried 2026-11-12), it has 31 listed victims across 17 countries, with the earliest discovery on 2026-09-03 and the earliest estimated attack date of 2026-07-06 (Palsana Enviro). Reported sectors are mainly Technology (11), Retail and E-Commerce (5), Manufacturing (3) and Energy and Utilities (2). Top victim countries are India (6), United States (5), Brazil (4), Viet Nam (2) and Nigeria (1). About 1008 GB is reported across 30 of 31 victims. The group blog is an onion service (Apache 2.4.68 on Debian) with about 91.7% 30-day uptime. The same-day listings of Franc-Oil (NG), Upper Web (BR) and Osiiminppal (GL), followed by Albion Online Data Project and Living Word Schools (2026-11-09) and ZipAI (2026-11-05), show continuing activity. Vendor reporting (Security Arsenal, 2026-09-05) describes roughly 1-2 posts per day and progressive release of data samples for non-payers, and assesses the operation as a closed or semi-private RaaS. That is an assessment, not a confirmed fact.

Attack mechanics are not documented. Security Arsenal explicitly states that no initial access vector, encrypted extension, ransom note text, encryption algorithm, file hashes or VEXY-specific IOCs are public, and that candidate CVEs it lists are plausible vectors only, not confirmed exploitation. Group-level indicators published by ransomware.live are the group Tox ID and two Bitcoin wallets. DNS-derived records for the victim domain (SPF IPs 5.161.208.104 and 46.21.148.130, WHOIS contact domain abusecosmotown.com) are victim-side infrastructure and are not confirmed attacker indicators. BeaconBeagle lookups for the two IPs returned HTTP 502 and could not be completed, so no C2 correlation is recorded.

MITRE ATT&CK techniques by tactic:

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Impact

T1490 Inhibit System Recovery; T1657 Financial Theft

Exfiltration

T1567 Exfiltration Over Web Service

Remediation

Patches

• No Vexy-specific CVE is confirmed; keep internet-facing appliances and remote-management software fully patched

Immediate actions

• Hunt for and block access to Vexy Ransomware group indicators (Tox ID, Bitcoin wallets) in threat-intel and payment-monitoring tooling
• Verify exposure of externally facing services and remote access (RDP, VPN, RMM) and enforce MFA on them
• Review egress logs for large archive transfers to cloud storage or unfamiliar hosts

Workarounds

• Restrict inbound RDP and management interfaces to VPN or allow-listed sources
• Rotate credentials for any account with suspected exposure

Longer-term hardening

• Maintain offline, immutable backups and test restores
• Deploy EDR with behavioral ransomware detection, including volume shadow copy deletion alerts
• Segment networks and restrict administrative tooling such as PsExec and WMI

Affected and fixed versions

• Osiiminppal — Corporate IT environment (www.osiiminppal.com)

Timeline

• 2026-07-06 Earliest estimated attack date attributed to Vexy Ransomware on ransomware.live (Palsana Enviro).
• 2026-09-03 Earliest Vexy Ransomware leak-site discovery recorded by ransomware.live (McDonald's Ecuador, Engefitas).
• 2026-09-05 Security Arsenal publishes analysis of five Vexy victims in four days, assessing a new closed or semi-private RaaS with no confirmed initial access vector.
• 2026-10-13 Vexy Ransomware lists Guarufilme (Brazil) on its leak site.
• 2026-10-16 Vexy claims Data-Core Systems and threatens a full leak unless a company representative makes contact.
• 2026-11-05 ZipAI (Viet Nam) listed by Vexy Ransomware.
• 2026-11-09 Albion Online Data Project and Living Word Schools (both US) listed, with estimated attack date 2026-11-07.
• 2026-11-12 Osiiminppal (locked-ioc-5) listed at 23:19 UTC with 100 MB claimed exfiltrated; Franc-Oil and Upper Web listed the same day.

Sources cited

• ransomware.live victim entry: Osiiminppal (Vexy Ransomware) ransomware.live · Research · 2026-11-12
• ransomware.live group page: Vexy Ransomware ransomware.live · Research · 2026-11-12
• ransomware.live victim entry: Palsana Enviro (PEPL) (Vexy Ransomware) ransomware.live · Research · 2026-09-04
• Security Arsenal: Vexy Ransomware Gang 5 New Victims in 4 Days securityarsenal.com · Blog · 2026-09-05
• DeXpose: Vexy Ransomware Strikes Data-Core Systems dexpose.io · News · 2026-10-16
• SOCRadar: Vexy Ransomware claims Guarufilme socradar.io · News · 2026-10-13
• SOCRadar: Groupe Proxitel Data Breach (Vexy Ransomware) socradar.io · News · 2026-09-29

More in ransomware

• Pixelleaks (new group) claims data leak from Huangshi Medical Laboratory / Ezong Medical Group x Getein JV (China, healthcare)
• Ransomware Leak-Site Cadence Analysis: INCRANSOM, TheGentlemen and Audit Team Run Active Intrusion Pipelines Amid Group Consolidation
• Vexy Ransomware lists Upper Web (Brazil, Technology) as a victim
• AI-Enabled Ransomware Evolution: Machine-Speed Kill Chains and Initial Access Broker Disruption (TrendAI Assessment, ARTEX Agentic Exploitation Context)
• Everest ransomware leak-site listing: "Final Notice Before Publication" (victim unnamed)

More from Vexy Ransomware

• Vexy Ransomware claims Franc-Oil (Nigeria, Energy & Utilities) - 200 MB exfiltration claimed
• Vexy Ransomware lists Living Word Schools (US education) as victim
• Vexy Ransomware claims Albion Online Data Project (16 GB exfiltrated)
• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated
• Vexy Ransomware claims JHAMF Group (IT services) - 110 GB exfiltrated
• Vexy Ransomware claims System Soft (Bulgaria) - 65 GB exfiltrated

Previous and next in ransomware

• Beast Ransomware (RaaS) Disables Backup Services, Deletes Shadow Copies, and Encrypts Network Drives Next report