# Vexy Ransomware lists Upper Web (Brazil, Technology) as a victim

> Ransomware.live lists Upper Web (upperweb.com.br), a Brazilian digital agency, as a victim of the Vexy Ransomware group, with 1.3 GB reportedly exfiltrated. The posting was discovered on 2026-11-12 and is an unverified leak-site claim; no CVE, TTPs, ransom note or labeled IOCs are published for this incident.

- **Published:** 2026-11-14T01:56:19Z
- **Last reviewed:** 2026-11-14T01:56:19Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-6019
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-6019.png
- **ID:** TL-2026-6019
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Vexy Ransomware
- **Detections:** 9 (1 shown free below) · **IOCs:** 13 (3 shown free below)

## Description

On 2026-11-12 at 23:18 UTC, ransomware.live recorded a leak-site posting by the Vexy Ransomware group naming Upper Web (upperweb.com.br), a Brazilian digital agency offering website development, e-commerce platforms, graphic design, branding and digital content creation (Technology sector). The entry reports 1.3 GB of data exfiltrated and an estimated attack date of 2026-11-12. The entry was last updated on 2026-11-13. The page does not state a victim-specific leak-site URL, ransom demand, ransom note, negotiation record or CVE. As with all leak-site listings, the claim has not been independently verified by the victim or a third party.

Vexy Ransomware is a newly observed extortion group. Per the ransomware.live group profile (updated 2026-11-13) it was first discovered on 2026-09-03, with the earliest victim's estimated attack date of 2026-07-06 and last activity on 2026-11-12. It has 31 posted victims across 17 countries, about 1008 GB of reported exfiltrated data across 30 of 31 victims, an average posting delay of 12 days, and a Tor leak blog (vexytsr3chimdz6siwaqi2lvxxwfkxvffkpwyanr2llequ2hkm56jvqd.onion, Apache 2.4.71 on Debian). Top sectors are Technology (11), Retail and E-Commerce (5), Manufacturing (3) and Energy and Utilities (2); top countries are India (6), United States (5), Brazil (4) and Viet Nam (2). The profile publishes a Tox ID and two Bitcoin wallet addresses as group contact and payment indicators. Other Brazilian victims reported in secondary sources include Engefitas (2026-09-02), Guarufilme (2026-10-13) and Logar Network Solutions.

Security Arsenal (2026-09-04/05), citing leak-site monitoring, reports that Vexy uses double extortion: victims are named under a countdown and data samples are progressively released for non-payers. No DDoS or customer-notification pressure (triple extortion) was observed. The same report describes initial access, lateral movement and encryption behavior only as an assessed, inferred playbook (edge VPN/RMM exploitation or exposed RDP with credential abuse or phishing, then Windows privilege escalation, RDP/WMI/PsExec lateral movement, staging with archive tools, exfiltration, and encryption preceded by shadow-copy deletion). It explicitly states that none of these were observed in Vexy incidents, that the CVEs it lists are plausible candidates and not confirmed as used, and that no Vexy hashes, domains, IPs or file names were available. The MITRE mappings in this record are therefore assessed behaviors consistent with the group's extortion model, not incident-confirmed TTPs. SOCRadar likewise cautions that leak-site listings cannot always be independently verified.

The SPF record of upperweb.com.br authorizes mail from 107.155.82.42 and 23.29.121.63 and includes spf.innserver12.net. These are the victim's mail-sending authorizations, not attacker infrastructure, and are recorded only as context. Severity is a conservative analyst judgment (MEDIUM) based on a single victim posting; it is not a source-stated rating. Defenders at Upper Web, its clients and its hosting or mail providers should treat the posting as a potential data-exposure event, validate it, and review credentials and client data held by the agency.

## MITRE ATT&CK

- T1657 Financial Theft
- T1490 Inhibit System Recovery
- T1021 Remote Services
- T1047 Windows Management Instrumentation
- T1569.002 System Services: Service Execution
- T1560.001 Archive via Utility

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Vexy Ransomware - Shadow Copy Deletion and Recovery Inhibition (SPL)** (`TL-2026-6019-SPL-001`)

Detects shadow copy deletion (vssadmin, wmic, diskshadow), boot recovery disablement (bcdedit) and backup catalog deletion (wbadmin), the pre-encryption step assessed for Vexy Ransomware (TL-2026-6019). No exploit or CVE is published for this incident, so this is the earliest high-fidelity observable behavior; the TTP is assessed from the group's extortion model, not incident-confirmed.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1490, T1486
- **Data sources:** sysmon
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| eval img=lower(Image), cmd=lower(CommandLine)
| eval vss_delete=if((match(img,"vssadmin[.]exe$") AND match(cmd,"delete[ ]+shadows")) OR (match(img,"wmic[.]exe$") AND match(cmd,"shadowcopy") AND match(cmd,"delete")) OR (match(img,"diskshadow[.]exe$") AND match(cmd,"delete")),1,0)
| eval recov_off=if(match(img,"bcdedit[.]exe$") AND (match(cmd,"recoveryenabled[ ]+no") OR match(cmd,"ignoreallfailures")),1,0)
| eval backup_del=if(match(img,"wbadmin[.]exe$") AND match(cmd,"delete[ ]+(catalog|backup|systemstatebackup)"),1,0)
| where vss_delete=1 OR recov_off=1 OR backup_del=1
| stats count as events sum(vss_delete) as vss_delete sum(recov_off) as recov_off sum(backup_del) as backup_del values(CommandLine) as commands values(ParentImage) as parent_images min(_time) as first_seen max(_time) as last_seen by host, User
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has_all ("delete", "shadows"))
    or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy" and ProcessCommandLine has "delete")
    or (FileName =~ "diskshadow.exe" and ProcessCommandLine has "delete")
    or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled no", "ignoreallfailures"))
    or (FileName =~ "wbadmin.exe" and ProcessCommandLine has_any ("delete catalog", "delete backup", "delete systemstatebackup"))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: Vexy Ransomware Behavior - Shadow Copy Deletion and Recovery Inhibition
id: 6f1d2c4e-8a3b-4c75-9e21-5b7a0d3c1f01
status: experimental
description: Detects shadow copy deletion, boot recovery disablement and backup catalog deletion, the pre-encryption behavior assessed for Vexy Ransomware (TL-2026-6019). Behavior is assessed from the group's extortion model, not incident-confirmed.
references:
    - https://www.ransomware.live/group/vexy
    - https://securityarsenal.com/blog/vexy-ransomware-gang-5-new-victims-in-4-days-india-and-latam-campaign-sector-analysis-and-detection-rules
author: Threadlinqs Team
date: 2026-11-14
tags:
    - attack.impact
    - attack.t1490
    - attack.t1486
logsource:
    category: process_creation
    product: windows
detection:
    sel_vssadmin:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'shadows'
    sel_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains|all:
            - 'shadowcopy'
            - 'delete'
    sel_diskshadow:
        Image|endswith: '\diskshadow.exe'
        CommandLine|contains: 'delete'
    sel_bcdedit:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains:
            - 'recoveryenabled no'
            - 'ignoreallfailures'
    sel_wbadmin:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains:
            - 'delete catalog'
            - 'delete backup'
            - 'delete systemstatebackup'
    condition: 1 of sel_*
falsepositives:
    - Backup or storage administrators pruning shadow copies during maintenance
    - Disk imaging or system deployment tooling
level: high

```

**Known false positives:**

- Backup or storage administrators pruning shadow copies during maintenance
- Disk imaging, system deployment or backup software resetting VSS state

**Tuning notes:** Allow-list known backup service accounts and parent processes; keep alert high priority and isolate the host on any match since shadow deletion typically precedes encryption. Command-line logging (4688) or Sysmon EventCode 1 is required.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Vexy Ransomware - Shadow Copy Deletion and Recovery Inhibition (KQL) (locked: unlock with TL Creds)
- Vexy Ransomware - Archive Utility Data Staging (KQL) (locked: unlock with TL Creds)
- Vexy Ransomware - PsExec and WMI Lateral Movement (KQL) (locked: unlock with TL Creds)
- Vexy Ransomware - Shadow Copy Deletion and Recovery Inhibition (Sigma) (locked: unlock with TL Creds)
- Vexy Ransomware - Archive Utility Data Staging (Sigma) (locked: unlock with TL Creds)
- Vexy Ransomware - PsExec and WMI Lateral Movement (Sigma) (locked: unlock with TL Creds)
- Vexy Ransomware - Archive Utility Data Staging (SPL) (locked: unlock with TL Creds)
- Vexy Ransomware - PsExec and WMI Lateral Movement (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 13)

Defanged, TLP:CLEAR.

- IP address: `107.155.82[.]42`
- Domain: `vexytsr3chimdz6siwaqi2lvxxwfkxvffkpwyanr2llequ2hkm56jvqd[.]onion`
- IP address: `23.29.121[.]63`

Full set of 13 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Ransomware.live victim entry: Upper Web / Vexy Ransomware](https://www.ransomware.live/id/VXBwZXIgV2ViQFZleHkgUmFuc29td2FyZQ)
- [Ransomware.live group profile: Vexy Ransomware](https://www.ransomware.live/group/vexy)
- [Security Arsenal: Vexy Ransomware Gang - 5 New Victims in 4 Days (India and LATAM campaign, sector analysis, detection rules)](https://securityarsenal.com/blog/vexy-ransomware-gang-5-new-victims-in-4-days-india-and-latam-campaign-sector-analysis-and-detection-rules)
- [SOCRadar: Vexy Ransomware claims Guarufilme](https://socradar.io/data-breach/vexy-ransomware-claims-guarufilme-october-13-2026/)
- [SOCRadar: Groupe Proxitel Data Breach (Vexy Ransomware)](https://socradar.io/blog/data-breach/groupe-proxitel-vexy-ransomware-2026/)
- [DeXpose: Vexy Ransomware Targets Logar Network Solutions in Brazil](https://www.dexpose.io/vexy-ransomware-targets-logar-network-solutions-in-brazil/)
- [DeXpose: Vexy Ransomware Strikes Data-Core Systems](https://www.dexpose.io/vexy-ransomware-strikes-data-core-systems/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-6019