vect Ransomware Group

Key insights

• •Vect utilizes a double-extortion model involving data exfiltration and encryption.
• •The ransomware's design flaw irreversibly destroys files larger than 128KB, making recovery impossible.
• •Initial access is primarily gained through supply chain compromises and stolen credentials.
• •Vect has active partnerships with TeamPCP for initial access exploits and BreachForums for affiliate recruitment.
• •The malware's occupation areas include Windows, Linux, and VMware ESXi systems.
• •All ransom demands are made exclusively in Monero (XMR).
• •The group employs defense evasion techniques, including the termination of security software.