The “new” VECT 2.0 ransomware is essentially a cross‑platform data wiper that permanently destroys most enterprise files rather than encrypting them for recovery.
For any file larger than 131,072 bytes (128 KB), VECT processes four separate chunks using four different randomly generated ChaCha20‑IETF nonces, but only writes the last nonce to disk at the end of the file.
The first three nonces are generated, used, and then discarded without being stored locally or exfiltrated, making the first three encrypted chunks mathematically unrecoverable for anyone, including the attackers themselves.
At a threshold of just 128 KB, this behavior affects almost every file type that matters in an enterprise, including VM disk images, database files, documents, archives, and backups.
Check Point Research (CPR) analyzed VECT 2.0 samples for Windows, Linux, and VMware ESXi and found a fundamental design flaw in the core encryption routine shared across all three platforms.
For this dominant class of “large” files, VECT 2.0 acts as a destructive wiper with a ransom note, not as recoverable ransomware, meaning victims who pay cannot receive a functional decryptor for the bulk of their critical data.
VECT 2.0 Ransomware Wipes
All three VECT 2.0 lockers are statically compiled C++ binaries built on the same libsodium‑based encryption engine, with identical file‑size thresholds, four‑chunk layout, and nonce handling logic.
In addition, VECT announced a partnership with BreachForums itself, promising that every registered forum user will become an affiliate and thus be able to use the VECT ransomware.
Windows, Linux, and ESXi variants each divide files over 128 KB into four offsets at 0, ¼, ½, and ¾ of the file size, encrypt up to 32 KB at each position, and then append only a single 12‑byte nonce to the end of the file, corresponding to the last chunk.
As a result, three‑quarters of each large file remain encrypted with missing nonces, while any bytes outside those four segments are left in plaintext, producing a corrupted mix of readable and unrecoverable content.
CPR also confirmed that previous VECT builds seen in the wild before the 2.0 release exhibit the same four‑chunk loop, shared nonce buffer, and single EOF nonce write, indicating the flaw has existed since the operation’s first observed deployments and has never been fixed.
Public reporting and even VECT’s own advertisements have incorrectly described the locker as using ChaCha20‑Poly1305 AEAD encryption.
CPR shows that the malware actually uses raw ChaCha20‑IETF via libsodium’s crypto_stream_chacha20_ietf_xor, with a 32‑byte key and 12‑byte nonce, and does not append any Poly1305 authentication tag to the ciphertext.
This means there is no message authentication code and no integrity protection at all; the on‑disk layout is simply ciphertext plus a nonce, not an authenticated encryption scheme.
VECT also exposes “encryption speed” flags such as –fast, –medium, and –secure in the Linux and ESXi variants, suggesting different coverage levels for performance tuning.
In practice, these options are parsed and stored but never used: every run applies the same 128 KB threshold and 32 KB chunk size regardless of operator selection, reinforcing the gap between the project’s professional marketing and its actual implementation.
RaaS Operation With Weak Engineering
Operationally, VECT positions itself as a Ransomware‑as‑a‑Service (RaaS) program, first advertised on a Russian‑language forum in late 2025 and tied to at least two victims by early 2026.
The encryption engine spawns worker threads in a fixed 1:7 scanner-to-encryptor ratio derived from a CPU-count-tiered multiplier: ×8 for machines with up to 4 CPUs, ×6 for 5-8 CPUs, and ×4 beyond that, hard-capped at 256 total.
Despite this aggressive expansion model, public leak infrastructure currently lists only a small number of victims, and the core locker still ships with glaring technical mistakes, from unreachable anti‑analysis code and self‑cancelling string “obfuscation” to an over‑threaded scheduler that degrades encryption performance.
The group later announced a partnership with the supply‑chain actor TeamPCP and with BreachForums, promising that all registered forum members could act as affiliates using VECT’s panel, lockers, negotiation platform, and leak site.
Security researchers now warn that organizations hit by VECT 2.0 should treat it as a data‑wiping incident and not as a recoverable ransomware case, since paying the ransom cannot bring back most destroyed files.
Defenders are urged to focus on robust offline backups, tested restore procedures, and early detection controls, as the malware’s design ensures that once large files are hit, the damage is permanent.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
