Inside Vect Ransomware-as-a-Service

Vect ransomware emerged in January 2026 as a new threat actor operating a Ransomware-as-a-Service program with strategic partnerships that significantly expand its reach. The group has partnered with TeamPCP, known for supply chain attacks compromising security tools like Trivy, KICS, and LiteLLM, and BreachForums, distributing affiliate keys to forum members. With 25 published victims primarily targeting the United States and Technology sector, Vect maintains an open affiliate program requiring only a $250 invite code. The operation offers multi-platform ransomware payloads for Windows, Linux, and ESXi with sophisticated lateral movement capabilities and tiered commission structures reaching 89% for top affiliates. Analysis reveals connections to the defunct Devman ransomware through shared code strings and ransom note similarities, suggesting possible rebranding or code reuse.

• VECT: Ransomware by design, Wiper by accidentMalware2026-04-28
• Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortionMalware2026-10-28
• INC and The Gentlemen Ransomware: Exposed AI InfrastructureMalware2026-10-21
• The Gentlemen: A closer look at a not-so-gentle ransomware-as-a-service operationMalware2026-10-21
• The Gentlemen are knocking: сustom backdoors and evolving tacticsMalware2026-06-29