VECT 2.0 ransomware has a critical flaw that causes files larger than 131,072 bytes to be permanently destroyed rather than encrypted. The malware encrypts four independent chunks of large files using four random 12-byte nonces but only appends the final nonce to the encrypted file on disk. The first three nonces are generated, used, and discarded without storage, making recovery impossible even with payment. The ransomware uses ChaCha20-IETF encryption which requires both the 32-byte key and exact matching 12-byte nonce for each chunk. Windows variant includes anti-analysis targeting 44 security tools, safe-mode persistence, and lateral movement capabilities. ESXi variant implements geofencing and anti-debugging checks, attempts SSH lateral movement. Both ESXi and Linux versions check for CIS country execution and exit without encryption if detected.