VECT: Ransomware That Can’t Decrypt

Morphisec • June 4, 2026

VECT ransomware can leave files renamed, partially encrypted or permanently damaged, even when attackers provide a decryptor. Learn how Windows-specific flaws create recovery challenges and why prevention-first security matters.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

VECT 2.0 Ransomware Compromises File Recovery for Victims VECT 2.0 ransomware has emerged as a significant threat, leaving victims unable to recover files even with the attackers' decryptor. This ransomware employs a flawed design that discards nonces for earlier parts of large files, leading to incomplete encryption and damaged files. The Windows-specific implementation introduces additional errors, such as buffer-size mismatches and inconsistent file processing. As a result, files can be renamed with a .vect suffix while remaining partially encrypted or entirely damaged. Ordinary business documents, PDFs, and databases are at risk, as VECT targets accessible folders while excluding certain system directories. Morphisec highlights the need for prevention-first security to combat this ransomware effectively. The situation is critical, as the ransomware's design flaws hinder recovery efforts even after ransom payment. 4 sources 68

Extracted Entities

VECT: Ransomware That Can’t Decrypt

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)

Ransomware Groups (1)