Researchers Detail Vect Ransomware’s Multi-Platform Payloads and Tactics
Summary
SpiderLabs analyzes Vect RaaS payloads for Windows, Linux and ESXi, detailing lateral movement, credential use, ChaCha20 encryption and process/VM termination. It reports links to TeamPCP and assesses a possible Devman connection that remains uncertain.
Key points
- The article reports that Vect emerged in January 2026 and that its leak site had listed 25 victims; these listings do not independently confirm the incidents.
- SpiderLabs reports Vect partnerships with TeamPCP and BreachForums, which it says expand affiliate access and the operation’s reach.
- Vect's builder supports Windows, Linux and ESXi payloads. The Windows sample uses RDP, SMB, WinRM, PSExec and CIM-based scheduled tasks for lateral movement.
- The Windows sample contains hardcoded Base64-encoded credentials and obfuscates strings with a rotating XOR routine; analysis found that its purported GPO deployment instead registers remote scheduled tasks through CIM.
- Linux and ESXi variants check locale and timezone settings to avoid specified regions, and terminate security, backup and database processes before encryption. The ESXi variant can also stop virtual machines.
- Vect encrypts files with ChaCha20, appends the .vect extension and offers different encryption modes; the article also describes a ransom note being placed in directories.
- Strings, debug logs, ransom-note similarities and a task-name prefix suggest a possible Devman connection, but the article says the relationship remains unclear.
Article Details
- Attack Vectors
- Vect affiliates can join through a paid invite code or receive an access key after registering on BreachForums.
- Affiliates generate Windows, Linux, and ESXi payloads through the Vect panel.
- The Windows payload propagates using RDP, SMB, WinRM, PSExec, and scheduled tasks registered through CIM; the Linux and ESXi variants support SSH spreading.
- Vect encrypts files with ChaCha20 and appends the .vect extension. The ESXi variant can terminate running virtual machines before encryption.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA1 | 488ed9ff65652a738042d93678591a579714a791 | SHA1 hash of a Vect Linux ransomware sample. |
| SHA1 | 69aa94434f545b41198b7d21f9acc71457584e62 | SHA1 hash of a Vect ESXi ransomware sample. |
| SHA1 | 9e18315690f148e1aa39facc39de913266bdcc13 | SHA1 hash listed among Vect ransomware samples. |
| SHA1 | e27f4feffc1ba6bf4e35aec4a5270fccb636e5cf | SHA1 hash of a Vect Windows ransomware sample. |
| SHA1 | f4b904fb6ba8474cb87f26302b74c4b82c106003 | SHA1 hash of a Vect ransomware sample. |
| SHA1 | f5287a33a806b8de0d62ac24edead4dcb9f60c2a | SHA1 hash listed among Vect ransomware samples. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe Windows payload copies itself to domain computers using RDP.T1021.002 · SMB/Windows Admin SharesThe Windows payload copies itself to ProgramData over SMB, with a local-subnet fallback if AD is unavailable.T1021.004 · SSHThe Linux and ESXi variants support SSH lateral movement.T1021.006 · Windows Remote ManagementThe Windows payload drops and remotely executes itself through a WinRM session.T1027 · Obfuscated Files or InformationThe Windows sample stores strings as encrypted bytes and decodes them at runtime using rotating XOR.T1047 · Windows Management InstrumentationThe Windows payload uses New-CimSession to interact with WMI over WinRM and register remote tasks.T1053.005 · Scheduled TaskThe Windows payload registers randomly named scheduled tasks remotely through CIM sessions, running them as SYSTEM.T1078 · Valid AccountsThe Windows payload uses embedded Base64-encoded credentials for spreading; affiliates can configure credentials or override them at runtime with --creds.T1486 · Data Encrypted for ImpactVect encrypts victim files with ChaCha20 and appends the .vect extension.T1529 · System Shutdown/RebootThe ESXi variant runs commands to forcibly terminate running virtual machines before encryption.T1552.001 · Credentials In FilesThe Windows sample embeds Base64-encoded credentials.T1562.001 · Disable or Modify ToolsThe Linux and ESXi variants use pkill -9 against listed security applications before encryption.T1569.002 · Service ExecutionThe Windows payload uses sc.exe to create a randomly named service on a target, execute the payload, and then delete the service.
Threat Actors
DevManThe article identifies Devman as a separate ransomware group and reports possible links to Vect based on payload strings, a hardcoded “DM” task-name prefix, and ransom-note similarities; the nature of any relationship remains unclear.TeamPCPSpiderLabs describes TeamPCP as a partner of Vect and links it to recent supply chain compromises involving Trivy, KICS, LiteLLM, and the Telnyx SDK.VectThe article describes Vect as a RaaS operation whose affiliates deploy ransomware payloads, publish victims on a leak site, and claim attacks through an X account.
Malware
Products
ESXiVect is a newly observed RaaS operation that has rapidly expanded through strategic partnerships with TeamPCP and BreachForums and supports multi-platform payloads for Windows, Linux, and ESXi.LiteLLMStrategic partnership with TeamPCP (linked to supply chain compromises of Trivy, KICS, LiteLLM, and Telnyx SDK) increases Vect’s potential reach and sophistication.Telnyx SDKStrategic partnership with TeamPCP (linked to supply chain compromises of Trivy, KICS, LiteLLM, and Telnyx SDK) increases Vect’s potential reach and sophistication.
Tools
KICSStrategic partnership with TeamPCP (linked to supply chain compromises of Trivy, KICS, LiteLLM, and Telnyx SDK) increases Vect’s potential reach and sophistication.PsExecWindows sample uses obfuscated strings (rotating XOR), multiple lateral movement methods (RDP, SMB, WinRM, PSExec, Scheduled Tasks via CIM), and hardcoded Base64 credentials that can be overridden at runtime.TrivyStrategic partnership with TeamPCP (linked to supply chain compromises of Trivy, KICS, LiteLLM, and Telnyx SDK) increases Vect’s potential reach and sophistication.