Vectorsoft AG Data Breach

ZaWoo ransomware group added Vectorsoft AG to its leak site on August 30, 2026, claiming unauthorized access to the German technology firm’s systems and data. The specific domain mentioned is vectorsoft[.]de. While this claim has not been independently verified, the persistent targeting of German technology firms by ZaWoo warrants serious attention to this incident. Over the past 60 days, ZaWoo has claimed 16 victims, with a notable concentration in Germany, Austria, and Canada. The group’s primary sector focus is on Technology, Manufacturing, and Professional Services. Vectorsoft AG, being a technology firm operating in Germany, aligns closely with ZaWoo’s typical targeting profile, suggesting a deliberate rather than opportunistic approach.

SOCRadar’s analysis of infostealer logs revealed limited exposure for vectorsoft[.]de. Specifically, one external-user record was identified on a customer-facing endpoint, with the record dated April 16, 2026. This finding does not represent direct employee credentials, and therefore, an internal compromise via stolen login information is not the most apparent attack vector in this instance. It is plausible that ZaWoo gained access through alternative methods, such as phishing campaigns, exploitation of exposed remote-access services, or by utilizing credentials obtained from sources outside the analyzed dataset. The presence of exposed customer-facing portal information also warrants review, as it may indicate reconnaissance activities targeting the organization’s customer base. The limited findings from the stealer-log analysis do not definitively confirm that Vectorsoft AG was unaffected by the intrusion, nor do they rule out a compromise. The group could have leveraged credentials from other sources or employed different initial access methods.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.