Vect Ransomware’s Encryption Flaw Can Leave Large Files Unrecoverable
Summary
A technical profile details Vect’s Windows, Linux and ESXi ransomware, reported links to TeamPCP supply-chain compromises, and a nonce-handling flaw that can leave three-quarters of large files unrecoverable; it also gives defensive guidance.
Key points
- The profile reports that Vect surfaced on December 31, 2025, and published 25 victim claims across five continents within four months.
- A BreachForums administrator reportedly distributed Vect affiliate keys to the forum’s 323,986 registered accounts.
- The article links Vect’s access pipeline to credentials harvested in TeamPCP supply-chain compromises involving Trivy, Checkmarx KICS, LiteLLM, and the Telnyx Python SDK.
- Vect’s locker supports Windows, Linux, and VMware ESXi. The article describes defense-tool termination, shadow-copy deletion, safe-mode changes, and several remote lateral-movement methods.
- For files larger than 128 KB, Vect encrypts four 32 KB chunks but reportedly retains only the final nonce. The article says this leaves three-quarters of each large file unrecoverable.
- The article presents possible Devman links based on naming conventions, ransom-note similarities, and timing, while noting that the evidence could indicate continuity, a rebrand, or a false flag.
- Recommended defenses include rotating secrets exposed to affected pipelines, monitoring for SafeBoot and shadow-copy changes, and maintaining offline, immutable backups.
Article Details
- Attack Vectors
- TeamPCP reportedly compromised software supply-chain and CI/CD paths affecting Trivy, Checkmarx KICS, LiteLLM, and the Telnyx Python SDK; credential-harvesting payloads collected secrets from downstream environments.
- Vect affiliates could supply credentials at build time or through the --creds parameter for RDP and VPN access; compromised Fortinet credentials were also solicited on a Russian-language forum.
- Vect supports lateral movement through remote scheduled tasks over CIM, SMB administrative shares, WMI, DCOM, remote service installation, WinRM, and SSH on Linux and ESXi.
- Affiliates reportedly exfiltrate data out of band using third-party tools such as Rclone or WinSCP, or may rely on data harvested upstream during the TeamPCP compromises.
- The locker encrypts files on Windows, Linux, and VMware ESXi; its large-file encryption flaw reportedly leaves three quarters of affected files unrecoverable.
- Defensive Notes
- Organizations exposed to the March 2026 TeamPCP campaign should rotate CI/CD secrets, GitHub Actions tokens, PyPI publishing tokens, cloud keys, SSH keys, Kubernetes tokens, and TLS certificates that passed through affected pipelines during the stated exposure period.
- Audit GitHub organizations for unexpected repositories named tpcp-docs and Python site-packages directories for unexpected .pth files.
- Block outbound Tor entry-node connectivity and onion-name resolution at the network perimeter.
- Monitor for bcdedit /set safeboot, SafeBoot registry modifications, vssadmin delete shadows /all /quiet, Set-MpPreference -DisableRealtimeMonitoring $true, and scheduled tasks or services with a DM prefix followed by four uppercase letters.
- Use tamper protection, phishing-resistant MFA for VMware ESXi management interfaces, network segmentation, and jump-host access.
- Pin GitHub Actions to immutable commit SHAs, enable PyPI Trusted Publishers where supported, and maintain offline immutable backups with regular restoration testing.
MITRE ATT&CK
T1021.002 · SMB/Windows Admin SharesVect propagates through SMB administrative-share copying.T1021.004 · SSHVect supports SSH-based propagation on Linux and VMware ESXi.T1053.005 · Scheduled TaskVect registers remote scheduled tasks over CIM sessions for lateral movement.T1059.001 · PowerShellVect execution and defense tampering use PowerShell, including a command that disables Microsoft Defender real-time monitoring.T1078 · Valid AccountsVect uses compromised or affiliate-supplied credentials for access and stores supplied credentials on target hosts.T1112 · Modify RegistryVect modifies SafeBoot Minimal and Network registry entries and a Run key to force a safe-mode reboot.T1133 · External Remote ServicesVect affiliates can supply credentials for RDP and VPN access.T1135 · Network Share DiscoveryVect enumerates accessible network shares using WNetOpenEnum and NetShareEnum.T1195.002 · Compromise Software Supply ChainTeamPCP reportedly compromised software supply-chain and CI/CD paths affecting Trivy, Checkmarx KICS, LiteLLM, and the Telnyx Python SDK to harvest downstream credentials.T1486 · Data Encrypted for ImpactVect encrypts files with ChaCha20; the reported nonce-handling flaw makes three quarters of large files unrecoverable.T1547.001 · Registry Run Keys / Startup FolderWith --force-safemode enabled, Vect writes a Run key as part of its safe-mode reboot behavior.T1555 · Credentials from Password StoresVect uses cmdkey to store affiliate-supplied credentials in Windows Credential Manager.T1562.001 · Disable or Modify ToolsVect disables Microsoft Defender real-time monitoring and terminates listed security agents before encryption.T1562.009 · Safe Mode BootVect can configure SafeBoot entries and reboot the host into safe mode, where the article says most endpoint protection is inactive.T1569.002 · Service ExecutionVect can execute through a service installed remotely with sc.exe.
Threat Actors
DevManThe article reports similarities between Devman and Vect in builder strings, lateral-movement task naming, and ransom notes. It says the link could reflect operator continuity, a rebrand, or a false flag; the relationship is unconfirmed.TeamPCPThe article attributes supply-chain compromises affecting Trivy, Checkmarx KICS, LiteLLM, and the Telnyx Python SDK to TeamPCP, which reportedly harvested credentials later associated with Vect operations.VectThe article describes Vect as a ransomware-as-a-service operation that published victim claims, recruited affiliates, and deployed ransomware across Windows, Linux, and VMware ESXi.
Malware
Vendors
CheckmarxVect’s operations are tied to TeamPCP, which harvested credentials through supply chain compromises affecting Trivy, Checkmarx KICS, LiteLLM, and Telnyx.FortinetVect operators retain alternative initial access paths, including compromised Fortinet credentials solicited on a Russian-language forum in January 2026, plus base64-encoded credentials supplied at build time or via theTelnyx#Vect
Products
Checkmarx KICSVect’s operations are tied to TeamPCP, which harvested credentials through supply chain compromises affecting Trivy, Checkmarx KICS, LiteLLM, and Telnyx.LiteLLM#VectMicrosoft Defender Antimalware Platformand disable defenses (‘Execution is initiated through PowerShell’, ‘a PowerShell command … disables Microsoft Defender real-time monitoring’).Telnyx Python SDKTrivy GitHub Actions workflow, the Checkmarx KICS package, the LiteLLM PyPI distribution, and the Telnyx Python SDK’).Trivy#VectVMware ESXiIts broken ChaCha20-based locker, aggressive defense evasion, and broad propagation across Windows, Linux, and VMware ESXi make it functionally similar to a wiper in many cases.
Tools
RClonesoon.” Exfiltration is performed either out of band by the affiliate using third-party tools such as Rclone, MEGA, or WinSCP, or with data already harvested upstream by TeamPCP during the original CI/CD compromise.WinSCPis performed either out of band by the affiliate using third-party tools such as Rclone, MEGA, or WinSCP, or with data already harvested upstream by TeamPCP during the original CI/CD compromise.
Countries
BrazilThe United States and Brazil lead as the most targeted countries, each accounting for 21.7% of victims, followed by India (17.4%) and South Africa (8.7%).EgyptThe remaining victims are distributed across Spain, Israel, Egypt, Italy, each representing 4.3%.IndiaThe United States and Brazil lead as the most targeted countries, each accounting for 21.7% of victims, followed by India (17.4%) and South Africa (8.7%).IsraelThe remaining victims are distributed across Spain, Israel, Egypt, Italy, each representing 4.3%.ItalyThe remaining victims are distributed across Spain, Israel, Egypt, Italy, each representing 4.3%.South AfricaThe United States and Brazil lead as the most targeted countries, each accounting for 21.7% of victims, followed by India (17.4%) and South Africa (8.7%).SpainThe remaining victims are distributed across Spain, Israel, Egypt, Italy, each representing 4.3%.United StatesThe United States and Brazil lead as the most targeted countries, each accounting for 21.7% of victims, followed by India (17.4%) and South Africa (8.7%).
Industries
Agriculture & Food ProductionBusiness Services follows at 12%, with Energy, Consumer Services, Education, and Agriculture & Food Production each representing 4%.business servicesBusiness Services follows at 12%, with Energy, Consumer Services, Education, and Agriculture & Food Production each representing 4%.Consumer ServicesBusiness Services follows at 12%, with Energy, Consumer Services, Education, and Agriculture & Food Production each representing 4%.EducationBusiness Services follows at 12%, with Energy, Consumer Services, Education, and Agriculture & Food Production each representing 4%.EnergyBusiness Services follows at 12%, with Energy, Consumer Services, Education, and Agriculture & Food Production each representing 4%.Financial ServicesFrom an industry perspective, Technology is the most impacted sector at 20%, while Financial Services, Healthcare, and Manufacturing each account for 16% of victims.HealthcareFrom an industry perspective, Technology is the most impacted sector at 20%, while Financial Services, Healthcare, and Manufacturing each account for 16% of victims.ManufacturingFrom an industry perspective, Technology is the most impacted sector at 20%, while Financial Services, Healthcare, and Manufacturing each account for 16% of victims.TechnologyFrom an industry perspective, Technology is the most impacted sector at 20%, while Financial Services, Healthcare, and Manufacturing each account for 16% of victims.