VECT: Ransomware by design, Wiper by accident

Check Point Research discovered critical flaws in VECT 2.0 ransomware affecting Windows, Linux, and ESXi platforms. A fundamental encryption implementation error causes files larger than 128 KB to be permanently destroyed rather than encrypted. The malware uses ChaCha20-IETF cipher but only saves one of four decryption nonces required for large files, making recovery impossible even after ransom payment. VECT's encryption speed modes are non-functional, thread scheduling degrades performance, and anti-analysis code is unreachable. Despite partnerships with TeamPCP and BreachForums for distribution, the technical implementation demonstrates amateur execution behind a professional facade. The nonce-handling flaw exists across all platform variants since initial deployment, effectively transforming this ransomware into a wiper for enterprise assets including VM disks, databases, and backups.

• Aurora ransomware targets ESXi abuses Cursor Agent for exploitationMalware2026-10-29
• Inside Vect Ransomware-as-a-ServiceMalware2026-04-30
• Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortionMalware2026-10-28
• The Gentlemen: A closer look at a not-so-gentle ransomware-as-a-service operationMalware2026-10-21
• Caught in 4K: The Gentlemen FilesMalware2026-10-05