New ransomware Vect exposed: cross-platform attacks and RaaS model pose multiple threats to enterprises

Introduction

On April 3, 2026, the CYFIRMA Research and Advisory Team released a weekly report revealing a new ransomware called Vect. This malware not only adopts a ransomware-as-a-service (RaaS) model, but also has cross-platform capabilities, targeting both Windows and Linux/ESXi systems. Vect operates through file encryption, system-setting tampering, and extortion pressure, and a data leak site has already appeared. Its targets span multiple critical industries, including manufacturing, education, healthcare, technology, and energy, across nine countries such as Brazil, the United States, and India. This discovery indicates that the ransomware threat is evolving toward greater professionalism, stealth, and scale, and enterprise security leaders must re-examine their defense systems.

Incident Overview

• Time: Report published on April 3, 2026
• Source: Discovered by the CYFIRMA threat research team during monitoring of underground forums
• Malware name: Vect Ransomware
• Target platforms: Windows, Linux/ESXi
• Target countries: Brazil, United States, India, South Africa, Egypt, Spain, Colombia, Italy, Namibia
• Target industries: Manufacturing, education, healthcare, technology, energy
• Known facts:
• - Appends the ".vect" extension to encrypted files
• - Changes the desktop wallpaper and drops a ransom note named "!!!_READ_ME_!!!.txt"
• - Claims to encrypt files using the ChaCha20 algorithm and exfiltrates sensitive data such as databases and backups
• - Uses the RaaS model, recruiting affiliate attackers and splitting profits
• - Uses a custom C++ codebase with cross-platform capabilities
• - Attack chain includes: initial access (phishing, credential theft, exposed RDP/VPN), execution via command-line interpreters, persistence via scheduled tasks, privilege escalation and credential dumping, system and network discovery, lateral movement via SMB/WinRM, data collection and encrypted exfiltration, encrypting files and deleting volume shadow copies

Technical and Risk Analysis

Attack Methods and Exploitation Chain

The attack workflow of Vect ransomware exhibits a highly structured nature, consistent with the typical "steal—encrypt—extort" model. Its initial access methods mainly rely on three vectors:

1. Phishing attacks: Using social engineering to trick users into executing malicious attachments or links. 2. Credential theft: Exploiting leaked account credentials, especially those without MFA enabled. 3. Exposed remote services: Such as poorly secured RDP and VPN entry points.Once access is obtained, Vect uses command-line interpreters (T1059) to execute malicious payloads and achieves persistence through registry modifications (T1112), creation of Windows services (T1543.003), and startup folders (T1547.001). Subsequently, attackers employ process injection (T1055.003) and credential dumping techniques to escalate privileges, and use reconnaissance methods such as system service discovery (T1007) and network share discovery (T1135) to locate high-value assets.

For lateral movement, Vect propagates via SMB and WinRM protocols, allowing it to spread rapidly across the entire internal network. Before final encryption, it collects data from local and shared drives and exfiltrates it through encrypted channels to anonymous infrastructure. Notably, Vect has the ability to run in Safe Mode, thereby bypassing some endpoint protections; at the same time, it disables security tools, stops backup services (T1489), and deletes volume shadow copies (vssadmin.exe Delete Shadows /all /quiet and wmic shadowcopy delete /nointeractive), greatly hindering victims' data recovery.

Technical Highlights: Evasion and Anti-Analysis

• Vect demonstrates advanced defense evasion capabilities, including:
• Virtualization/Sandbox Evasion (T1497): Detects debugging environments and virtual machine characteristics to decide whether to release the full payload.
• Reflective Code Loading (T1620): Loads malicious code directly in memory to avoid dropping files to disk.
• Hidden Windows (T1564.003): Hides malicious windows to confuse users.
• Removal of Malicious Tool Traces (T1070.004): Deletes operation logs and files to increase forensic difficulty.

These techniques indicate that Vect is not a simple script but a tool continuously maintained by a professional team, with strong anti-detection capabilities.

Affected Assets and Enterprise Risks

• Vect attacks span a broad enterprise asset matrix, including:
• Endpoint Devices: Windows workstations, servers
• Virtualization Infrastructure: VMware ESXi / cloud hosts
• Identity and Access Management Systems: Stolen domain credentials
• Data Storage: Databases, backup repositories, shared file servers

• Enterprises attacked by Vect will face:
• Operational Disruption: Core business systems encrypted, production halted; service stoppage (T1489) renders critical applications unavailable.
• Financial Loss: Ransom payments, revenue loss from business downtime, and data recovery costs.
• Compliance Risk: If personal data breaches are involved, the enterprise may violate regulations such as GDPR and HIPAA and face regulatory penalties.
• Brand Reputation Damage: Data leak sites publicly display sensitive data, undermining customer trust.## Enterprise Impact Analysis

The impact of Vect ransomware on enterprises goes beyond mere data encryption; its double-extortion strategy amplifies the risk. Attackers not only encrypt files but also threaten to publicly disclose stolen data, forcing enterprises into a dilemma over whether to pay the ransom. In manufacturing, encrypted PLC configurations or MES systems can halt production lines; in healthcare, patient record leaks can trigger serious compliance issues; educational institutions may suffer reputational damage from leaked examinee data or research results.

More concerning, Vect's encryption capability targeting Linux/ESXi means traditional Windows-only defense strategies are no longer sufficient. Enterprises' critical business workloads on cloud environments or virtualization platforms are equally at risk. Moreover, the RaaS model lowers the barrier to attack, enabling more small and medium-sized criminal groups to launch ransomware attacks, expanding the attack surface.

Industry Trend Observations

The exposure of Vect is not an isolated incident but reflects the ongoing evolution of the ransomware ecosystem:

1. Cross-platform attacks becoming the norm: Expanding from Windows to Linux/ESXi shows attackers are targeting broader components of enterprise infrastructure, especially virtualization and cloud environments. 2. RaaS model maturing: Specialized division of labor has commoditized attack tools, allowing non-technical criminals to launch sophisticated attacks, leading to a surge in ransomware incidents. 3. Double extortion becoming standard: Data theft + encryption as "double extortion" has become mainstream, forcing enterprises to choose between data leakage and business disruption. 4. Supply chain and critical infrastructure in focus: The target industries in the report are mostly critical infrastructure and involve multiple countries, showing attackers tend to choose high-impact targets to maximize ransom gains. 5. AI and automation integration: Although Vect does not explicitly mention AI, its automated reconnaissance and lateral movement capabilities already exhibit semi-automated characteristics. In the future, combining with AI may enable faster and more precise attacks.

These trends indicate that ransomware is no longer scattered crime but has become an organized, industrialized black economy. Enterprises must adopt more proactive and resilient defense strategies.

Defense and Response Recommendations

Enterprise Level - Strengthen Identity and Access Management (IAM): Fully enable multi-factor authentication (MFA), especially for remote access channels such as RDP and VPN. Implement the principle of least privilege to restrict privileged account usage. - Deploy Zero Trust Architecture: Trust no device or user by default, continuously verify access requests, and perform micro-segmentation on north-south and east-west traffic. - Improve Patch Management: Patch known vulnerabilities promptly, especially for internet-facing systems and services. ### Technical Level - Deploy EDR/XDR: Leverage endpoint detection and response (EDR) or extended detection and response (XDR) solutions to monitor common ransomware behaviors (such as shadow copy deletion, abnormal process injection, and suspicious script execution). - Strengthen network monitoring: Use SIEM for correlated log analysis, focusing on indicators such as abnormal SMB/WinRM connections and data exfiltration traffic. - Threat intelligence integration: Subscribe to threat intelligence sources such as CYFIRMA to obtain the latest IoCs (indicators of compromise) and TTPs (tactics, techniques, and procedures), and set blocking rules on firewalls and threat platforms. - Backup and recovery: Adopt the 3-2-1 principle, regularly test restoration processes, and store backups in locations isolated from the production network. However, note that Vect deletes backups; consider immutable backups or offline storage.

Management Level - Develop an incident response plan: Clarify in advance the decision-making process, communication mechanisms, and recovery steps for ransomware incidents. - Third-party risk management: Review the security posture of supply chain partners to prevent intrusion through vendors. - Employee security training: Strengthen phishing email identification training to reduce the initial attack surface. - Compliance preparation: Clarify data breach notification obligations and ensure reports are submitted to regulatory authorities within the required time window.

SecurityPost Insight

The exposure of Vect ransomware is by no means an ordinary threat warning. It reveals that the ransomware industry is evolving toward becoming more professional, more covert, and more resilient. Vect's cross-platform capabilities, RaaS model, security mode bypass, and double extortion features mean that enterprises can no longer rely on traditional antivirus and backup strategies to address threats. Security leaders must treat ransomware as a systemic risk, integrating identity security, endpoint protection, network monitoring, backup recovery, and personnel awareness into a defense-in-depth system. At the same time, Vect's targeting of Linux/ESXi reminds us that cloud and virtualization environments have become the new high ground for attackers, and security teams need to extend their protection vision across the entire infrastructure stack. In the future, we expect such cross-platform ransomware attacks to appear more frequently, and their attack speed will increase significantly when combined with AI. Enterprises should closely monitor threat intelligence developments and proactively conduct red team exercises and disaster recovery tests to ensure that when a real attack occurs, they can quickly detect, isolate, and recover, rather than merely responding passively.