Vect 2.0 RaaS Expands Attacks Across Windows, Linux, and ESXi

Vect 2.0 Ransomware‑as‑a‑Service (RaaS) operation is rapidly evolving into a multi‑platform threat that can encrypt Windows, Linux, and VMware ESXi environments across modern hybrid infrastructures.

The group runs a classic affiliate model, renting out its ransomware and TOR‑based infrastructure to partners in exchange for a share of ransom payments.

Its operators are strongly suspected to be based in the Commonwealth of Independent States (CIS), such as Russia or Belarus, based on recruitment incentives and language preferences.

Vect first appeared in late 2025 but has now rebranded as “Vect 2.0,” signaling a more mature, professional RaaS operation with upgraded tooling and infrastructure.

During February 2026, Vect 2.0 accounted for roughly 1.6% of analyzed ransomware incidents, already placing it among emerging mid‑tier players like Nova and Tengu in terms of operational tempo and sophistication.

Triple‑Extortion and Multi‑Platform Payloads

Vect 2.0 explicitly advertises an “Exfiltration, Encryption, Extortion” model, combining data theft, environment‑wide crypto‑locking, and public shaming on a Data Leak Site (DLS) to pressure victims into paying.

The group maintains custom C‑based payloads, including svchostupdate.exe for Windows and encesxi.elf for Linux and ESXi systems, enabling broad coverage across enterprise endpoints and virtualized infrastructure.

The ransomware can terminate key processes, delete or inhibit backups, and encrypt data at scale, with encrypted files tagged using the .vect extension.

This multi‑platform design allows affiliates to hit file servers, domain controllers, and hypervisors in a single campaign, significantly increasing blast radius and recovery complexity.

As of 28 February 2026, Vect 2.0’s DLS listed 20 active victims, with data for 6 organizations already published and 14 more under negotiation.

While external trackers observed 18 claimed victims, the DLS provides the most accurate count due to the group’s own archive and removal policies.

Victims span multiple regions, with Brazil and the United States each recording four cases, India three, and additional organizations in South Africa, Egypt, Spain, Colombia, Italy, and Namibia.

Targeted sectors include manufacturing, education, healthcare, and technology, highlighting a focus on organizations with critical operational or personal data and often limited downtime tolerance.

Vect 2.0 affiliates rely on a blend of tried‑and‑tested techniques mapped closely to the MITRE ATT&CK framework. Reported methods include:

• Valid accounts and weak or stolen credentials for initial access (T1078).
• External remote services such as RDP and VPN (T1133).
• Phishing campaigns to deliver loaders or steal credentials (T1566).
• Command and scripting interpreters for execution (T1059) and scheduled tasks for persistence (T1053).

For lateral movement, they use SMB admin shares (T1021.002) and Windows Remote Management (WinRM) (T1021.006), while discovery techniques enumerate services, systems, and file shares before staging data and launching the final encryption phase.

A notable hallmark is the use of Safe Mode boot to evade security controls, achieved via bcdedit manipulation and rebooting into a reduced‑defence environment (T1562.009).

Command‑and‑control and data exfiltration rely on web protocols over encrypted TOR channels, with at least one historical clear‑net IP (158.94.210.11:8000) tied to early infrastructure.

Dark Web Presence and RaaS Model

Vect 2.0 operates a TOR‑only DLS and negotiation portal, refusing any clear‑net presence to reduce exposure.

Communications with victims and affiliates are handled via TOX, and all ransom payments are demanded in Monero (XMR) to maximize financial anonymity.

The RaaS based program includes a 250 USD entry fee for affiliates, waived for CIS‑based applicants, supported by a private “Vect Secure Chat” system that uses unique chat IDs for controlled access.

The group also enforces an archive policy in which cases older than six months remain listed, even after resolution, to maintain long‑term pressure and reputational damage against victims.

Defenders should prioritize blocking known indicators of compromise, including the historical IP 158.94.210.11:8000, TOR access where business‑appropriate, and the identified Windows and ESXi payload names (svchostupdate.exe, encesxi.elf).

Continuous monitoring of bcdedit changes, Safe Mode reboots, aggressive security‑tool termination, and unusual remote‑access patterns can provide early signals of Vect 2.0 activity.

Strong multi‑factor authentication, hardened ESXi management interfaces, segmented networks, and immutable offline backups remain critical controls to limit both initial compromise and the impact of any successful intrusion.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.