VECT 2.0 Flaw Permanently Destroys Files Larger Than 131 KB
Summary
Check Point Research says VECT 2.0’s Windows, Linux and ESXi lockers discard three required encryption nonces, irreversibly destroying files over 131,072 bytes; operators cannot decrypt them. The analysis also details platform-specific evasion and spread features.
Key points
- Check Point Research found that files larger than 131,072 bytes are irrecoverable because the lockers discard three of four nonces needed to decrypt their chunks.
- The flaw affects VECT 2.0 variants for Windows, Linux, and ESXi; ransom payment cannot restore affected files.
- The Windows variant targets security and debugging tools, can persist through Safe Mode, and includes scripts for lateral movement.
- The ESXi variant uses geofencing and anti-debugging checks and attempts lateral movement over SSH; the Linux version shares its codebase and has fewer features.
- The article reports that VECT 2.0 has a RaaS affiliate program and partnerships with BreachForums and TeamPCP.
- Check Point says the analyzed lockers use a weaker unauthenticated cipher than the ChaCha20-Poly1305 encryption initially claimed by the group.
Article Details
- Attack Vectors
- VECT 2.0 is distributed through a ransomware-as-a-service affiliate program; the article reports a formal partnership with BreachForums and TeamPCP intended to expand distribution.
- The Windows variant encrypts files on local, removable, and network-accessible storage.
- The ESXi variant attempts lateral movement using SSH.
- The Windows variant can configure Safe Mode boot and register its executable to run on the subsequent Safe Mode boot.
- The ESXi variant checks for debugging conditions and exits without encrypting files in CIS countries; Ukraine is included in the exclusions.
- Defensive Notes
- Prioritize offline backups and tested recovery procedures; the article reports that files larger than 131,072 bytes may be irrecoverable even if a ransom is paid.
- Use rapid containment during a VECT 2.0 incident; the article cautions that payment is not a viable recovery strategy.
MITRE ATT&CK
T1021.004 · SSHThe ESXi variant attempts lateral movement using SSH.T1480 · Execution GuardrailsThe ESXi variant checks whether it is running in a CIS country and exits without encrypting files if so.T1485 · Data DestructionVECT 2.0 permanently destroys files larger than 131,072 bytes because it discards the nonces needed to recover encrypted chunks.T1486 · Data Encrypted for ImpactThe ransomware encrypts files across local, removable, and network-accessible Windows storage, and has Windows, Linux, and ESXi variants.T1547 · Boot or Logon Autostart ExecutionWith “–force-safemode” active, the Windows variant writes its executable path to the Windows Registry to run on the subsequent Safe Mode boot.T1622 · Debugger EvasionThe ESXi variant performs anti-debugging checks before starting encryption.
People
Threat Actors
TeamPCPThe article identifies TeamPCP as a hacking group and reports a partnership with VECT 2.0; the two listed victims are said to have been compromised through TeamPCP supply-chain attacks.VECT 2.0The article describes VECT 2.0 as a cybercriminal ransomware-as-a-service operation with an affiliate program. It reports a partnership with BreachForums and TeamPCP to expand attack distribution.
Malware
Products
ESXiVECT 2.0 is marketed as ransomware but a critical flaw in its encryption across Windows, Linux, and ESXi causes files larger than 131,072 bytes to be permanently destroyed, making recovery impossible.LinuxVECT 2.0 is marketed as ransomware but a critical flaw in its encryption across Windows, Linux, and ESXi causes files larger than 131,072 bytes to be permanently destroyed, making recovery impossible.Microsoft WindowsVECT 2.0 is marketed as ransomware but a critical flaw in its encryption across Windows, Linux, and ESXi causes files larger than 131,072 bytes to be permanently destroyed, making recovery impossible.