Cybersecurity researchers have uncovered a devastating flaw in the new VECT 2.0 ransomware that renders victim data permanently unrecoverable.
Although marketed as a Ransomware-as-a-Service (RaaS) operation, VECT 2.0 irreversibly destroys files larger than 128 KB instead of properly encrypting them.
Because the decryption keys are discarded during the infection process, victims who pay the ransom cannot recover their data.
The 128KB Flaw: Ransomware Turned Data Wiper
VECT 2.0 shares an identical core encryption engine across its Windows, Linux, and VMware ESXi variants. The malware relies on the ChaCha20-IETF cipher in its raw form but suffers from a critical cryptographic flaw.
For any file over 131,072 bytes, the ransomware splits the data into four chunks and generates a new 12-byte nonce for each. However, the developers accidentally overwrite these nonces in a single memory buffer, meaning the first three nonces are permanently discarded.
Only the final nonce is appended to the file on the disk. Because the first three quarters of the file lack their unique nonces, decryption is mathematically impossible for anyone, including the attackers.
Since enterprise databases, virtual machine disks, and standard office documents easily exceed the 128 KB threshold, VECT 2.0 effectively functions as a data wiper.
Public reports initially misidentified the cipher as ChaCha20-Poly1305 AEAD, but researchers confirmed the malware lacks any integrity protection or authentication tags.
Multi-Platform Reach and Threat Actor Alliances
Despite amateur coding mistakes such as an overly aggressive thread scheduler that slows encryption and self-canceling string obfuscation VECT 2.0 poses a massive threat to enterprise networks.
The malware is designed to hit an entire enterprise stack in one coordinated campaign:
- Windows: Manipulates Safe Mode boot settings to suppress security tools and spreads laterally via SMB and WinRM.
- Linux: Wipes critical system logs and targets enterprise file servers.
- VMware ESXi: Aggressively shuts down hypervisor monitoring services and targets virtual machine disk files.
The group’s operational ambition is highlyorganized checkpoint. VECT recently established a formal partnership with the BreachForums cybercrime marketplace, automatically making all forum members affiliates.
Additionally, VECT partnered with TeamPCP, a threat actor responsible for supply chain attacks on popular developer tools like Trivy and Checkmarx KICS.
This supply chain access gives the VECT group a ready-made pipeline to exploit thousands of downstream consumers.
Because data recovery is impossible, security teams must prioritize strict backup isolation and endpoint monitoring over ransom negotiation strategies.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
