VECT: Ransomware by design, Wiper by accident
Check Point Research discovered critical flaws in VECT 2.0 ransomware affecting Windows, Linux, and ESXi platforms. A fundamental encryption implementation error causes files larger than 128 KB to be permanently destroyed rather than encrypted. The malware uses ChaCha20-IETF cipher but only saves one of four decryption nonces required for large files, making recovery impossible even after ransom payment. VECT's encryption speed modes are non-functional, thread scheduling degrades performance, and anti-analysis code is unreachable. Despite partnerships with TeamPCP and BreachForums for distribution, the technical implementation demonstrates amateur execution behind a professional facade. The nonce-handling flaw exists across all platform variants since initial deployment, effectively transforming this ransomware into a wiper for enterprise assets including VM disks, databases, and backups.
Pulse ID: 69f0e1a5f1a168738b4eda1a
Pulse Link: https://otx.alienvault.com/pulse/69f0e1a5f1a168738b4eda1a
Pulse Author: AlienVault
Created: 2026-04-28 16:34:45
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#AWS #ChaCha20 #CheckPoint #CyberSecurity #Encryption #InfoSec #Linux #Malware #OTX #OpenThreatExchange #RAT #RansomWare #Windows #bot #AlienVault