VECT 2.0’s Nonce Flaw Makes Large Files Irrecoverable, Check Point Finds
Summary
Check Point Research says VECT 2.0 stores only one of four nonces used to encrypt files larger than 131,072 bytes, making three chunks unrecoverable across its Windows, Linux, and ESXi variants.
Key points
- The report says VECT 2.0 encrypts files over 131,072 bytes in four chunks with separate random nonces, but appends only the final nonce; the first three chunks cannot be decrypted.
- Check Point found the same nonce-handling flaw in the Windows, Linux, and ESXi variants, which share an encryption design built with libsodium.
- The researchers identified the cipher as raw ChaCha20-IETF without Poly1305 authentication, contrary to descriptions of ChaCha20-Poly1305.
- Advertised --fast, --medium, and --secure modes are parsed but ignored; the report says each run uses the same hardcoded file-size and chunk thresholds.
- The analysis also found excessive thread counts and anti-analysis routines that are compiled but never invoked.
- VECT includes platform-specific lateral-movement capabilities, including WMI, SMB, and remote execution options on Windows and SSH-based movement on Linux and ESXi.
Article Details
- Attack Vectors
- VECT 2.0 encrypts files in place on Windows, Linux, and ESXi. Files larger than 131,072 bytes are processed in four chunks, but only the final chunk’s nonce is saved, leaving the first three chunks unrecoverable.
- The Windows variant supports lateral movement using administrative-share file copies, SMB, WMI, DCOM/MMC, remote scheduled tasks, remote service installation, and PowerShell remoting with operator-supplied credentials.
- The Linux and ESXi variants support SSH-based spread: they collect readable SSH keys, parse SSH configuration for hosts and usernames, then copy the payload with scp and execute it over ssh.
- VECT announced a partnership with TeamPCP and stated a goal of exploiting companies affected by TeamPCP supply-chain attacks. The article does not establish that VECT carried out those intended attacks.
- Defensive Notes
- The report says files larger than 131,072 bytes lose three of the four required nonces and cannot be restored by the attacker; paying the ransom cannot recover those files.
- Check Point states that Threat Emulation and Harmony Endpoint provide coverage for the attacks described in the report.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 58e17dd61d4d55fa77c7f2dd28dd51875b0ce900c1e43b368b349e65f27d6fdd | VECT ESXi sample hash listed in the report. |
| SHA256 | 8ee4ec425bc0d8db050d13bbff98f483fff020050d49f40c5055ca2b9f6b1c4d | VECT Windows sample hash listed in the report. |
| SHA256 | 9c745f95a09b37bc0486bf0f92aad4a3d5548a939c086b93d6235d34648e683f | VECT Windows sample hash listed in the report. |
| SHA256 | a7eadcf81dd6fda0dd6affefaffcb33b1d8f64ddec6e5a1772d028ef2a7da0f2 | VECT ESXi sample hash listed in the report. |
| SHA256 | e1fc59c7ece6e9a7fb262fc8529e3c4905503a1ca44630f9724b2ccc518d0c06 | VECT Linux sample hash listed in the report. |
| SHA256 | e512d22d2bd989f35ebaccb63615434870dc0642b0f60e6d4bda0bb89adee27a | VECT Windows sample hash listed in the report. |
MITRE ATT&CK
T1021.002 · SMB/Windows Admin SharesThe Windows variant supports administrative-share file copies and SMB-based lateral movement.T1021.003 · Distributed Component Object ModelThe Windows variant includes DCOM/MMC application instantiation for remote execution.T1021.004 · SSHThe Linux and ESXi variants copy themselves with scp and execute over ssh on reachable hosts.T1021.006 · Windows Remote ManagementThe Windows variant supports PowerShell remoting for lateral movement.T1047 · Windows Management InstrumentationThe Windows variant uses WMI for remote execution and lateral movement.T1053.005 · Scheduled TaskThe Windows variant can create remote scheduled tasks to execute on other hosts.T1070.001 · Clear Windows Event LogsThe Windows variant clears Application, Security, System, and Windows PowerShell event logs with wevtutil.T1195.002 · Compromise Software Supply ChainThe article reports that TeamPCP attacks injected malware into software packages including Trivy, Checkmarx’ KICS, LiteLLM, and Telnyx.T1485 · Data DestructionFor files over 131,072 bytes, VECT discards three chunk nonces, permanently destroying the corresponding file data.T1486 · Data Encrypted for ImpactVECT encrypts files in place with ChaCha20-IETF as its disruptive action.T1490 · Inhibit System RecoveryThe Windows variant deletes shadow copies using vssadmin.T1543.003 · Windows ServiceWith safe-mode persistence enabled, the Windows variant writes its executable path into the registry safe-boot service load path.T1552.001 · Credentials In FilesThe Linux and ESXi variants extract readable SSH keys from home directories and parse SSH configuration files.T1562.001 · Disable or Modify ToolsThe Windows variant uses PowerShell Set-MpPreference commands to disable Windows Defender scanning features.T1562.004 · Disable or Modify System FirewallThe ESXi variant disables the ESXi firewall and firewall rulesets before encryption.
Threat Actors
TeamPCPThe article describes TeamPCP as the actor behind several supply-chain attacks that injected malware into software packages. VECT announced a partnership with TeamPCP and a goal of exploiting companies affected by those attacks; the article does not confirm that VECT carried out that stated plan.VectIdentified in the article as a ransomware-as-a-service group operating a multi-platform ransomware program. The group announced an open-affiliate arrangement and a partnership with TeamPCP; the article reports two victims on its leak site, both linked to TeamPCP supply-chain attacks.
Malware
Vendors
Products
Check Point Threat EmulationCheck Point Threat Emulation and Harmony Endpoint provide comprehensive coverage of attack tactics, file types, and operating systems and protect against the attacks and threats described in this report.ESXiThe flaw is identical across Windows, Linux, and ESXi variants built from a single libsodium-based codebase and is accompanied by other implementation errors such as misidentified cipher, parsed-but-ignored speed flags,Harmony EndpointCheck Point Threat Emulation and Harmony Endpoint provide comprehensive coverage of attack tactics, file types, and operating systems and protect against the attacks and threats described in this report.LinuxThe flaw is identical across Windows, Linux, and ESXi variants built from a single libsodium-based codebase and is accompanied by other implementation errors such as misidentified cipher, parsed-but-ignored speed flags,Microsoft WindowsThe flaw is identical across Windows, Linux, and ESXi variants built from a single libsodium-based codebase and is accompanied by other implementation errors such as misidentified cipher, parsed-but-ignored speed flags,