Most ransomware encrypts your data and demands payment to unlock it. Vect 2.0 skips the second part. A critical flaw in its code permanently destroys any file larger than 131KB, meaning victims who pay get nothing back. Researchers at Check Point discovered this, and the implications for enterprise security teams are significant.
Vect 2.0 is a Ransomware-as-a-Service program that first appeared in December 2025 on a Russian-language cybercrime forum. The group claimed its first two victims in January 2026 and released version 2.0 in February 2026, expanding its reach across Windows, Linux, and VMware ESXi systems.
Vect 2.0 operates under the “Exfiltration, Encryption, Extortion” model, combining data theft and encryption with public shaming on a data leak site to pressure victims into paying. An entry fee of $250, payable in Monero, is required for affiliates, with the fee waived for applicants from CIS countries.
The malware gained visibility in March 2026 when Vect announced a partnership with TeamPCP, a threat actor behind supply-chain attacks that injected malware into widely-used packages including Trivy, Checkmarx KICS, LiteLLM, and Telnyx. The group also established a formal partnership with BreachForums, giving every registered forum member free access to deploy the ransomware as an affiliate.
As of late February 2026, Vect 2.0’s data leak site listed 20 active victims, with data already published for six organizations and 14 more under negotiation. Victims span multiple regions, with Brazil and the United States each recording four cases, India three, and additional organizations in South Africa, Egypt, Spain, Colombia, Italy, and Namibia.
Here is the part that changes the calculus entirely. Despite its polished builder panel, a critical coding flaw effectively turns it into a data wiper. Any file exceeding 131,072 bytes is not properly encrypted but instead rendered permanently unrecoverable. Check Point’s Eli Smadja confirmed that paying a ransom is futile, since the decryption information is destroyed immediately as the malware operates.
Windows, Linux, and ESXi variants an identical encryption design built on libsodium, with the same file-size thresholds and the same nonce-handling flaw throughout, confirming a single codebase ported across all three platforms. That means the destruction is consistent regardless of which system gets hit.
The ESXi variant targets VMware ESXi hypervisors, wiping logs and encrypting victim files at the VMware File System mount point. It also supports SSH-based lateral movement, attempting to use available credentials to connect to known SSH hosts. A single compromised ESXi host can cascade across every virtual machine running on it.
Targeted sectors include manufacturing, education, healthcare, and technology, with a focus on organizations that have critical operational or personal data and often limited downtime tolerance. These are exactly the environments where file destruction, not mere encryption, causes the most irreversible damage.
The convergence of supply chain credential theft, a maturing RaaS operation, and mass dark web forum mobilization represents an unprecedented model of industrialized ransomware deployment. The low affiliate barrier means more attackers will gain access to these tools, regardless of the technical flaws underneath.
Because paying does not work with Vect 2.0, prevention and recovery preparation are the only viable approaches.
Vect 2.0 moves fast and hits multiple systems at once – exactly the scenario where manual triage fails and automated correlation becomes critical. Secure.com’s SOC Teammate is built for this: cross-platform threat detection with human-supervised response, giving teams the detection and response speed they need before file destruction begins.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
