VECT 2.0 Ransomware Can Permanently Destroy Large Files
Summary
Check Point researchers say VECT 2.0 overwrites encryption nonces when processing file chunks, leaving only the final 25% of large files recoverable. The flaw reportedly affects Windows, Linux, and ESXi variants.
Key points
- VECT 2.0 reuses a memory buffer for nonce output, overwriting each previous chunk’s nonce.
- Only the final chunk’s nonce is retained, so researchers say only the last 25% of a large file can be recovered.
- The lost nonces are not sent to the attackers, meaning ransom payment would not restore the affected file.
- Check Point researchers found the flaw in Windows, Linux, and ESXi variants.
- VECT operators advertised the ransomware on BreachForums and announced a partnership with TeamPCP to target supply-chain compromises.
Article Details
- Attack Vectors
- VECT operators advertised the ransomware on BreachForums, invited registered users to become affiliates, and sent access keys by private message.
- VECT operators said they planned to deploy ransomware against victims of supply-chain compromises and conduct larger supply-chain attacks.
MITRE ATT&CK
T1485 · Data DestructionBecause earlier chunk nonces are overwritten and neither retained nor transmitted, most affected large files are effectively destroyed and cannot be restored through ransom decryption.T1486 · Data Encrypted for ImpactVECT 2.0 encrypts files in chunks; its nonce-handling flaw leaves only the final chunk recoverable.