Vexy Ransomware lists Upper Web (Brazil, Technology) as a victim

Key facts

Detection coverage

As of 2026-11-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-6019 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Vexy Ransomware - Shadow Copy Deletion and Recovery Inhibition (SPL)

Detects shadow copy deletion (vssadmin, wmic, diskshadow), boot recovery disablement (bcdedit) and backup catalog deletion (wbadmin), the pre-encryption step assessed for Vexy Ransomware (TL-2026-6019). No exploit or CVE is published for this incident, so this is the earliest high-fidelity observable behavior; the TTP is assessed from the group's extortion model, not incident-confirmed.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1490, T1486
• Data sources: sysmon
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| eval img=lower(Image), cmd=lower(CommandLine)
| eval vss_delete=if((match(img,"vssadmin[.]exe$") AND match(cmd,"delete[ ]+shadows")) OR (match(img,"wmic[.]exe$") AND match(cmd,"shadowcopy") AND match(cmd,"delete")) OR (match(img,"diskshadow[.]exe$") AND match(cmd,"delete")),1,0)
| eval recov_off=if(match(img,"bcdedit[.]exe$") AND (match(cmd,"recoveryenabled[ ]+no") OR match(cmd,"ignoreallfailures")),1,0)
| eval backup_del=if(match(img,"wbadmin[.]exe$") AND match(cmd,"delete[ ]+(catalog|backup|systemstatebackup)"),1,0)
| where vss_delete=1 OR recov_off=1 OR backup_del=1
| stats count as events sum(vss_delete) as vss_delete sum(recov_off) as recov_off sum(backup_del) as backup_del values(CommandLine) as commands values(ParentImage) as parent_images min(_time) as first_seen max(_time) as last_seen by host, User
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has_all ("delete", "shadows"))
    or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy" and ProcessCommandLine has "delete")
    or (FileName =~ "diskshadow.exe" and ProcessCommandLine has "delete")
    or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled no", "ignoreallfailures"))
    or (FileName =~ "wbadmin.exe" and ProcessCommandLine has_any ("delete catalog", "delete backup", "delete systemstatebackup"))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Sigma

title: Vexy Ransomware Behavior - Shadow Copy Deletion and Recovery Inhibition
id: 6f1d2c4e-8a3b-4c75-9e21-5b7a0d3c1f01
status: experimental
description: Detects shadow copy deletion, boot recovery disablement and backup catalog deletion, the pre-encryption behavior assessed for Vexy Ransomware (TL-2026-6019). Behavior is assessed from the group's extortion model, not incident-confirmed.
references:
    - https://www.ransomware.live/group/vexy
    - https://securityarsenal.com/blog/vexy-ransomware-gang-5-new-victims-in-4-days-india-and-latam-campaign-sector-analysis-and-detection-rules
author: Threadlinqs Team
date: 2026-11-14
tags:
    - attack.impact
    - attack.t1490
    - attack.t1486
logsource:
    category: process_creation
    product: windows
detection:
    sel_vssadmin:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'shadows'
    sel_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains|all:
            - 'shadowcopy'
            - 'delete'
    sel_diskshadow:
        Image|endswith: '\diskshadow.exe'
        CommandLine|contains: 'delete'
    sel_bcdedit:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains:
            - 'recoveryenabled no'
            - 'ignoreallfailures'
    sel_wbadmin:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains:
            - 'delete catalog'
            - 'delete backup'
            - 'delete systemstatebackup'
    condition: 1 of sel_*
falsepositives:
    - Backup or storage administrators pruning shadow copies during maintenance
    - Disk imaging or system deployment tooling
level: high

Known false positives:

• Backup or storage administrators pruning shadow copies during maintenance
• Disk imaging, system deployment or backup software resetting VSS state

Tuning notes: Allow-list known backup service accounts and parent processes; keep alert high priority and isolate the host on any match since shadow deletion typically precedes encryption. Command-line logging (4688) or Sysmon EventCode 1 is required.

• 🔒 Vexy Ransomware - Shadow Copy Deletion and Recovery Inhibition (KQL) · unlock with TL Creds
• 🔒 Vexy Ransomware - Archive Utility Data Staging (KQL) · unlock with TL Creds
• 🔒 Vexy Ransomware - PsExec and WMI Lateral Movement (KQL) · unlock with TL Creds
• 🔒 Vexy Ransomware - Shadow Copy Deletion and Recovery Inhibition (Sigma) · unlock with TL Creds
• 🔒 Vexy Ransomware - Archive Utility Data Staging (Sigma) · unlock with TL Creds
• 🔒 Vexy Ransomware - PsExec and WMI Lateral Movement (Sigma) · unlock with TL Creds
• 🔒 Vexy Ransomware - Archive Utility Data Staging (SPL) · unlock with TL Creds
• 🔒 Vexy Ransomware - PsExec and WMI Lateral Movement (SPL) · unlock with TL Creds

Indicators of compromise

As of 2026-11-14, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-6019.

Sample indicators (3 of 13)

• IP address: 107.155.82[.]42
• Domain: vexytsr3chimdz6siwaqi2lvxxwfkxvffkpwyanr2llequ2hkm56jvqd[.]onion
• IP address: 23.29.121[.]63

Defanged, TLP:CLEAR. Full set of 13 indicators: unlock with TL Creds.

Technical analysis

On 2026-11-12 at 23:18 UTC, ransomware.live recorded a leak-site posting by the Vexy Ransomware group naming Upper Web (upperweb.com.br), a Brazilian digital agency offering website development, e-commerce platforms, graphic design, branding and digital content creation (Technology sector). The entry reports 1.3 GB of data exfiltrated and an estimated attack date of 2026-11-12. The entry was last updated on 2026-11-13. The page does not state a victim-specific leak-site URL, ransom demand, ransom note, negotiation record or CVE. As with all leak-site listings, the claim has not been independently verified by the victim or a third party.

Vexy Ransomware is a newly observed extortion group. Per the ransomware.live group profile (updated 2026-11-13) it was first discovered on 2026-09-03, with the earliest victim's estimated attack date of 2026-07-06 and last activity on 2026-11-12. It has 31 posted victims across 17 countries, about 1008 GB of reported exfiltrated data across 30 of 31 victims, an average posting delay of 12 days, and a Tor leak blog (vexytsr3chimdz6siwaqi2lvxxwfkxvffkpwyanr2llequ2hkm56jvqd.onion, Apache 2.4.71 on Debian). Top sectors are Technology (11), Retail and E-Commerce (5), Manufacturing (3) and Energy and Utilities (2); top countries are India (6), United States (5), Brazil (4) and Viet Nam (2). The profile publishes a Tox ID and two Bitcoin wallet addresses as group contact and payment indicators. Other Brazilian victims reported in secondary sources include Engefitas (2026-09-02), Guarufilme (2026-10-13) and Logar Network Solutions.

Security Arsenal (2026-09-04/05), citing leak-site monitoring, reports that Vexy uses double extortion: victims are named under a countdown and data samples are progressively released for non-payers. No DDoS or customer-notification pressure (triple extortion) was observed. The same report describes initial access, lateral movement and encryption behavior only as an assessed, inferred playbook (edge VPN/RMM exploitation or exposed RDP with credential abuse or phishing, then Windows privilege escalation, RDP/WMI/PsExec lateral movement, staging with archive tools, exfiltration, and encryption preceded by shadow-copy deletion). It explicitly states that none of these were observed in Vexy incidents, that the CVEs it lists are plausible candidates and not confirmed as used, and that no Vexy hashes, domains, IPs or file names were available. The MITRE mappings in this record are therefore assessed behaviors consistent with the group's extortion model, not incident-confirmed TTPs. SOCRadar likewise cautions that leak-site listings cannot always be independently verified.

The SPF record of upperweb.com.br authorizes mail from 107.155.82.42 and 23.29.121.63 and includes spf.innserver12.net. These are the victim's mail-sending authorizations, not attacker infrastructure, and are recorded only as context. Severity is a conservative analyst judgment (MEDIUM) based on a single victim posting; it is not a source-stated rating. Defenders at Upper Web, its clients and its hosting or mail providers should treat the posting as a potential data-exposure event, validate it, and review credentials and client data held by the agency.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021 Remote Services

Execution

T1047 Windows Management Instrumentation; T1569.002 System Services: Service Execution

Impact

T1490 Inhibit System Recovery; T1657 Financial Theft

Collection

T1560.001 Archive via Utility

Remediation

Patches

• No CVE is named for this incident; keep internet-facing appliances and remote-access software on current vendor patches

Immediate actions

• Verify the Upper Web listing with the victim and preserve evidence before any contact with the actor
• Reset credentials, API keys and secrets for systems and client environments held by the agency (hosting panels, CMS admin, e-commerce back ends, email)
• Review remote access paths (VPN, RDP, RMM tools) for unexpected logons and new accounts
• Monitor the Vexy leak blog and ransomware.live for published data samples and notify affected clients as required (LGPD in Brazil)

Workarounds

• Restrict exposed RDP and management interfaces to VPN or allow-listed addresses
• Alert on vssadmin, wmic shadowcopy, diskshadow and bcdedit recoveryenabled changes

Longer-term hardening

• Enforce MFA on all remote access and administrative accounts
• Maintain offline, immutable backups and test restores
• Deploy EDR with behavioral rules for shadow-copy deletion, mass service stops, archive-based staging and PsExec/WMI lateral movement
• Segment client environments and limit the data an agency holds about clients

Affected and fixed versions

• Upper Web — Corporate environment (upperweb.com.br), digital agency

Timeline

• 2026-07-06 Earliest Vexy victim estimated attack date recorded by ransomware.live.
• 2026-09-03 Ransomware.live first discovers the Vexy Ransomware group via its leak-site postings.
• 2026-09-04 Security Arsenal reports five Vexy victims posted 2026-09-02 to 2026-09-04 (India and LATAM), double extortion observed.
• 2026-10-13 SOCRadar reports Vexy claim against Brazilian media company Guarufilme.
• 2026-11-05 Vexy lists ZipAI (Viet Nam).
• 2026-11-09 Vexy lists Albion Online Data Project and Living Word Schools (US).
• 2026-11-12 Vexy lists Upper Web (locked-ioc-5), Brazil, Technology; 1.3 GB reportedly exfiltrated; discovered 23:18 UTC. Franc-Oil and Osiiminppal posted the same day.
• 2026-11-13 Ransomware.live updates the Upper Web entry and Vexy group profile (31 victims, 17 countries, ~1008 GB claimed).

Sources cited

• Ransomware.live victim entry: Upper Web / Vexy Ransomware ransomware.live · Research · 2026-11-12
• Ransomware.live group profile: Vexy Ransomware ransomware.live · Research · 2026-11-13
• SOCRadar: Vexy Ransomware claims Guarufilme socradar.io · Research · 2026-10-13
• SOCRadar: Groupe Proxitel Data Breach (Vexy Ransomware) socradar.io · Research · 2026-10-01
• Security Arsenal: Vexy Ransomware Gang - 5 New Victims in 4 Days (India and LATAM campaign, sector analysis, detection rules) securityarsenal.com · Blog · 2026-09-04
• DeXpose: Vexy Ransomware Targets Logar Network Solutions in Brazil dexpose.io · News · 2026-10-01
• DeXpose: Vexy Ransomware Strikes Data-Core Systems dexpose.io · News · 2026-10-16

More in ransomware

• Pixelleaks (new group) claims data leak from Huangshi Medical Laboratory / Ezong Medical Group x Getein JV (China, healthcare)
• Ransomware Leak-Site Cadence Analysis: INCRANSOM, TheGentlemen and Audit Team Run Active Intrusion Pipelines Amid Group Consolidation
• AI-Enabled Ransomware Evolution: Machine-Speed Kill Chains and Initial Access Broker Disruption (TrendAI Assessment, ARTEX Agentic Exploitation Context)
• Everest ransomware leak-site listing: "Final Notice Before Publication" (victim unnamed)
• Qilin Ransomware Claims Cyberattack on University of Texas at Arlington; Personal Data Stolen

More from Vexy Ransomware

• Vexy Ransomware lists Osiiminppal on leak site (100 MB claimed exfiltration)
• Vexy Ransomware claims Franc-Oil (Nigeria, Energy & Utilities) - 200 MB exfiltration claimed
• Vexy Ransomware lists Living Word Schools (US education) as victim
• Vexy Ransomware claims Albion Online Data Project (16 GB exfiltrated)
• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated
• Vexy Ransomware claims JHAMF Group (IT services) - 110 GB exfiltrated