VECT 2.0 Ransomware Irreversibly Destroys Files Over 131KB on Windows, Linux, ESXi

Published:

28 april 2026 om 14:01:00

Alert date:

28 april 2026 om 15:01:28

Source:

thehackernews.com

Ransomware & Malware, Operating Systems, Cloud & Virtualization

VECT 2.0 ransomware contains a critical flaw in its encryption implementation that causes it to act more like a wiper than ransomware. The malware permanently destroys files larger than 131KB rather than encrypting them, making recovery impossible even for the threat actors themselves. This affects Windows, Linux, and ESXi systems. The implementation flaw means victims cannot recover their data even if they pay ransom demands, making this particularly destructive malware.

Technical details

VECT 2.0 ransomware has a critical flaw that causes files larger than 131,072 bytes to be permanently destroyed rather than encrypted. The malware encrypts four independent chunks of large files using four random 12-byte nonces but only appends the final nonce to the encrypted file on disk. The first three nonces are generated, used, and discarded without storage, making recovery impossible even with payment. The ransomware uses ChaCha20-IETF encryption which requires both the 32-byte key and exact matching 12-byte nonce for each chunk. Windows variant includes anti-analysis targeting 44 security tools, safe-mode persistence, and lateral movement capabilities. ESXi variant implements geofencing and anti-debugging checks, attempts SSH lateral movement. Both ESXi and Linux versions check for CIS country execution and exit without encryption if detected.

Mitigation steps:

Focus on resilience rather than negotiation as paying ransom will not recover data. Implement offline backups, tested recovery procedures, and rapid containment. Do not rely on decryption as recovery strategy since decryption keys are destroyed during encryption process. Strengthen backup and disaster recovery capabilities.

Affected products:

Windows
Linux
ESXi