Vect
| RaaS
VECT is a RaaS group that launched its affiliate program in December 2025 with a five-tier revenue-sharing model and a formal partnership with BreachForums; its VECT 2.0 payload contains a critical encryption flaw that irreversibly destroys files larger than 128 KB rather than encrypting them.
Victims
25
First Victim
2025-10-05
(est. attack date)
Discovery Date
2026-01-06
Last Seen
2026-04-15
Inactive Since
133
days
Avg Delay
23.5
days
Infostealer
12.0%
victims with domain
Countries
12
hit
Uptime
0.0% avg (30d)
Attack Velocity — Last 12 months (based on attack estimated date if available)
Known Locations (3)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | Status | |
|---|---|---|---|---|---|---|---|---|
|
VECT RANSOMWARE // DATA ARCHIVE | No | 2026-08-22T08:43:06 |
bu7zr6fotni3qxxoxlcmpikwtp5mjzy7jkxt7akflnm2kwkbdtgtjuid.onion
|
||||
|
VECT RANSOMWARE // DATA ARCHIVE | No | 2026-08-22T08:44:41 |
vectordntlcrlmfkcm4alni734tbcrnd5lk44v6sp4lqal6noqrgnbyd.onion
|
||||
|
No | 2026-08-26T17:38:30 |
breach5yz2b5lepmq4gaqwcon3jippw3bislhvvdavem5git55sy2nid.onion
|
Target
Top 5 Activity Sectors
- Technology 5
- Manufacturing 4
- Financial Services 4
- Healthcare 4
- Professional Services 3
Top 5 Countries
-
United States
5
-
Brazil
5
-
India
4
-
South Africa
2
-
Israel
1
Heatmap
Ransom Notes (1)
YARA Rules (1)
Indicators of Compromise (IoCs) (1)
Tox
1
| Type | IOC |
|---|---|
Tox
|
1A51DCBB33FBF603B385D223F599C6D64545E631F7C870FFEA320D84CE5DAF076C1F94100B5B
|
Victims (25)
Status: STATUS: NEGOTIATING | Sector: Business Services | Internal projects, secrets, api keys etc D…
Status: STATUS: NEGOTIATING | Sector: property management | internal projects, 4 million sent/receiv…
Status: STATUS: NEGOTIATING | Sector: Energy | DATA SIZE: 238GB | Deadline: 22d 3h…
Status: STATUS: NEGOTIATING | Sector: manufacturer | Employee Data, CMS, CMR, SAP databases. | Deadl…
Status: STATUS: NEGOTIATING | Sector: Real Estate | DATA SIZE: 200GB | Deadline: 29d 7h…
Status: STATUS: NEGOTIATING | Sector: Seller | ├─ Web server and local development environment files…
Status: STATUS: LEAKED | Sector: asset management | │ ├─Accounting and bookkeeping system data (Sage…
Status: STATUS: LEAKED | Sector: Manifacturer | Production control records
Daily production logs…
Status: STATUS: LEAKED | Sector: Finance | Customer financial records (loans, savings, balances)
…
Status: STATUS: LEAKED | Sector: healthcare | Employee personally identifiable information (PII)
Pay…
Status: STATUS: NEGOTIATING | Sector: accounting | ├─ Public/shared company directories (general, ac…
Status: STATUS: NEGOTIATING | Sector: Healthcare | PII data, clients medical records, and HIV tests …
Status: STATUS: NEGOTIATING | Sector: Education | financial records, students data, etc etc DATA SIZ…
Status: STATUS: NEGOTIATING | Sector: Engineering Solutions | All data exfiltrated including PII, em…