# Vexy Ransomware lists Osiiminppal on leak site (100 MB claimed exfiltration)

> Ransomware.live recorded a leak-site listing by the Vexy Ransomware group for victim Osiiminppal (www.osiiminppal.com), discovered 2026-11-12 23:19 UTC with an estimated attack date of 2026-11-12 and 100 MB of data claimed exfiltrated. The listing is a group claim and is not independently verified.

- **Published:** 2026-11-13T00:22:01Z
- **Last reviewed:** 2026-11-13T00:22:01Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5906
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5906.png
- **ID:** TL-2026-5906
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Vexy Ransomware
- **Detections:** 9 (1 shown free below) · **IOCs:** 16 (3 shown free below)

## Description

On 2026-11-12 at 23:19 UTC, the ransomware.live tracker recorded a new victim post by the Vexy Ransomware group naming Osiiminppal (www.osiiminppal.com). The entry gives an estimated attack date of 2026-11-12, 100 MB of exfiltrated data, a country flag code of GL, and no sector (listed as Not Found). The ParanoidLab exposure report attached to the entry shows 0 exposed passwords and 0 cookies. No ransom note, encrypted-file extension, malware binary, hashes or initial access vector is published for this victim.

Vexy Ransomware is a double-extortion leak-site group. Per the ransomware.live group page (queried 2026-11-12), it has 31 listed victims across 17 countries, with the earliest discovery on 2026-09-03 and the earliest estimated attack date of 2026-07-06 (Palsana Enviro). Reported sectors are mainly Technology (11), Retail and E-Commerce (5), Manufacturing (3) and Energy and Utilities (2). Top victim countries are India (6), United States (5), Brazil (4), Viet Nam (2) and Nigeria (1). About 1008 GB is reported across 30 of 31 victims. The group blog is an onion service (Apache 2.4.68 on Debian) with about 91.7% 30-day uptime. The same-day listings of Franc-Oil (NG), Upper Web (BR) and Osiiminppal (GL), followed by Albion Online Data Project and Living Word Schools (2026-11-09) and ZipAI (2026-11-05), show continuing activity. Vendor reporting (Security Arsenal, 2026-09-05) describes roughly 1-2 posts per day and progressive release of data samples for non-payers, and assesses the operation as a closed or semi-private RaaS. That is an assessment, not a confirmed fact.

Attack mechanics are not documented. Security Arsenal explicitly states that no initial access vector, encrypted extension, ransom note text, encryption algorithm, file hashes or VEXY-specific IOCs are public, and that candidate CVEs it lists are plausible vectors only, not confirmed exploitation. Group-level indicators published by ransomware.live are the group Tox ID and two Bitcoin wallets. DNS-derived records for the victim domain (SPF IPs 5.161.208.104 and 46.21.148.130, WHOIS contact domain abusecosmotown.com) are victim-side infrastructure and are not confirmed attacker indicators. BeaconBeagle lookups for the two IPs returned HTTP 502 and could not be completed, so no C2 correlation is recorded.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft
- T1490 Inhibit System Recovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Vexy Ransomware Initial Access — Brute-Force then Successful RDP/Network Logon from External IP (T1133)** (`TL-2026-5906-SPL-001`)

Detects an external (non-RFC1918) source IP with 10+ failed Windows logons followed by at least one successful network/RDP logon against the same host in the same hour. Vexy Ransomware's initial access vector is unconfirmed (TL-2026-5906); public reporting lists only plausible vectors and remediation guidance centres on exposed RDP/VPN/RMM. This is a behaviour-first rule for External Remote Services (T1133) using valid or guessed accounts (T1078, T1110); it is not Vexy-specific.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1133, T1078, T1110
- **Data sources:** windows_security (index=wineventlog, sourcetype=WinEventLog:Security, EventCode 4624/4625), Microsoft Defender DeviceLogonEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=wineventlog sourcetype="WinEventLog:Security" (EventCode=4625 OR EventCode=4624) Logon_Type IN (3,10) earliest=-24h
| where isnotnull(src_ip) AND src_ip!="-" AND src_ip!="::1" AND src_ip!="127.0.0.1"
| where NOT (cidrmatch("10.0.0.0/8",src_ip) OR cidrmatch("172.16.0.0/12",src_ip) OR cidrmatch("192.168.0.0/16",src_ip))
| bin _time span=1h
| stats count(eval(EventCode=4625)) as failures count(eval(EventCode=4624)) as successes dc(user) as distinct_users values(user) as users by src_ip dest _time
| where failures>=10 AND successes>=1
| eval detection="TL-2026-5906-SPL-001", technique="T1133;T1078;T1110"
| table _time detection dest src_ip failures successes distinct_users users technique
```

### Microsoft KQL

```kql
// TL-2026-5906 — external logon success after failure burst (T1133 / T1078 / T1110)
DeviceLogonEvents
| where Timestamp > ago(24h)
| where LogonType in ("RemoteInteractive", "Network") and isnotempty(RemoteIP)
| where ipv4_is_private(RemoteIP) == false
| summarize Failures=countif(ActionType == "LogonFailed"), Successes=countif(ActionType == "LogonSuccess"),
    DistinctUsers=dcount(AccountName), Users=make_set(AccountName, 10), FirstSeen=min(Timestamp)
    by RemoteIP, DeviceName, TimeBin=bin(Timestamp, 1h)
| where Failures >= 10 and Successes >= 1
| project TimeBin, DeviceName, RemoteIP, Failures, Successes, DistinctUsers, Users, FirstSeen
```

### Sigma

```yaml
title: Vexy Ransomware Initial Access - RDP Logon From Non-Private Source IP
id: 5b1f6c3e-7a42-4d58-9e0a-1c3b8f2d4a61
status: experimental
description: Detects successful RDP (logon type 10) logons from a non-private source IP, a common external remote services entry point (T1133) for ransomware operators. Initial access for Vexy Ransomware is unconfirmed.
references:
    - https://www.ransomware.live/id/T3NpaW1pbnBwYWxAVmV4eSBSYW5zb213YXJl
    - https://ransomware.live/group/Vexy%20Ransomware
    - https://securityarsenal.com/blog/vexy-ransomware-gang-5-new-victims-in-4-days-india-and-latam-campaign-sector-analysis-and-detection-rules
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.initial_access
    - attack.persistence
    - attack.t1133
    - attack.t1078
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4624
        LogonType: 10
    filter_private:
        IpAddress|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '127.0.0.0/8'
    filter_local:
        IpAddress:
            - '-'
            - '::1'
    condition: selection and not 1 of filter_*
falsepositives:
    - Administrators or vendors connecting over a sanctioned RDP gateway with a public egress IP
    - Cloud jump hosts or VPN concentrators NATing user traffic
level: medium

```

**Known false positives:**

- Legitimate administrators or vendors reaching RDP/SMB from a public egress IP
- Users repeatedly mistyping passwords before succeeding via a VPN/NAT address
- Vulnerability scanners or password-audit tools run from an external range

**Tuning notes:** Raise or lower the failures>=10 threshold per environment; allow-list known VPN/jump-host egress IPs and vendor ranges; restrict to internet-exposed servers via a lookup; ensure Windows Security 4624/4625 auditing is enabled and src_ip is CIM-normalised (Source_Network_Address).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Vexy Ransomware Exploitation — Public-Facing Web/App Service Spawning Shell or LOLBin (T1190) (locked: unlock with TL Creds)
- Vexy Ransomware Impact — Mass File Rename / Extension Change by a Single Process (T1486) (locked: unlock with TL Creds)
- Vexy Ransomware Exfiltration — Rclone/MEGA/SFTP Tooling and Onion or File-Share Network Connections (T1567.002) (locked: unlock with TL Creds)
- Vexy Ransomware Access Persistence — Silent Install of Remote Management Tooling (T1133/T1219) (locked: unlock with TL Creds)
- Vexy Ransomware Defense Evasion — Microsoft Defender Disabled or Excluded via PowerShell (T1562.001) (locked: unlock with TL Creds)
- Vexy Ransomware C2/Extortion Channel — DNS Query for Onion Domains or Vexy Leak-Site Address (T1090.003) (locked: unlock with TL Creds)
- Vexy Ransomware Impact — Shadow Copy Deletion and Recovery Inhibition (T1490) (locked: unlock with TL Creds)
- Vexy Ransomware Exfiltration — Large Upload to File-Sharing Services, Tor Gateways or Vexy Infrastructure (T1567) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 16)

Defanged, TLP:CLEAR.

- IP address: `5.161.208[.]104`
- Domain: `vexytsr3chimdz6siwaqi2lvxxwfkxvffkpwyanr2llequ2hkm56jvqd[.]onion`
- IP address: `46.21.148[.]130`

Full set of 16 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [ransomware.live victim entry: Osiiminppal (Vexy Ransomware)](https://www.ransomware.live/id/T3NpaW1pbnBwYWxAVmV4eSBSYW5zb213YXJl)
- [ransomware.live group page: Vexy Ransomware](https://ransomware.live/group/Vexy%20Ransomware)
- [Security Arsenal: Vexy Ransomware Gang 5 New Victims in 4 Days](https://securityarsenal.com/blog/vexy-ransomware-gang-5-new-victims-in-4-days-india-and-latam-campaign-sector-analysis-and-detection-rules)
- [DeXpose: Vexy Ransomware Strikes Data-Core Systems](https://www.dexpose.io/vexy-ransomware-strikes-data-core-systems/)
- [SOCRadar: Vexy Ransomware claims Guarufilme](https://socradar.io/data-breach/vexy-ransomware-claims-guarufilme-october-13-2026/)
- [SOCRadar: Groupe Proxitel Data Breach (Vexy Ransomware)](https://socradar.io/blog/data-breach/groupe-proxitel-vexy-ransomware-2026/)
- [ransomware.live victim entry: Palsana Enviro (PEPL) (Vexy Ransomware)](https://ransomware.live/id/UGFsc2FuYSBFbnZpcm8gKFBFUEwpQFZleHkgUmFuc29td2FyZQ)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5906