Scworld

Emergence of Vect RaaS Operation Targeting Organizations in Brazil and South Africa

First seen 5 Feb 2026, 06:48 UTC • Infosecurity-Magazine

•39.0

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The newly identified Vect ransomware-as-a-service (RaaS) operation has compromised organizations in Brazil and South Africa. Launched in December 2025, Vect employs C++-based malware utilizing the ChaCha20-Poly1305 AEAD encryption algorithm and SafeMode execution to target Windows, Linux, and VMware ESXi systems.

Ask AI about this cluster

Answers cite the sources they use

How this analysis works

Attack Flow

14 entities, 25 inferred relationships (STIX 2.1).

Technique (5)

Ransomware
T1078 - Valid Accounts
T1190 - Exploit Public-Facing Application
T1486 - Data Encrypted for Impact
T1566 - Phishing

Affected Platform (4)

Linux
VMware ESXi
Windows
Tor

Threat Actor (3)

Conti
Lockbit 3.0
Vect

Tool (2)

Monero
TOX Protocol

Relationships

Conti uses Monero
Conti uses TOX Protocol
Lockbit 3.0 uses Monero
Lockbit 3.0 uses TOX Protocol
Vect uses Monero
Vect uses TOX Protocol
Conti uses Ransomware
Conti uses T1078 - Valid Accounts
Conti uses T1190 - Exploit Public-Facing Application
Conti uses T1486 - Data Encrypted for Impact
Conti uses T1566 - Phishing
Lockbit 3.0 uses Ransomware
Lockbit 3.0 uses T1078 - Valid Accounts
Lockbit 3.0 uses T1190 - Exploit Public-Facing Application
Lockbit 3.0 uses T1486 - Data Encrypted for Impact
Lockbit 3.0 uses T1566 - Phishing
Vect uses Ransomware
Vect uses T1078 - Valid Accounts
Vect uses T1190 - Exploit Public-Facing Application
Vect uses T1486 - Data Encrypted for Impact
Vect uses T1566 - Phishing
Conti related to Linux
Conti related to VMware ESXi
Conti related to Windows
Conti related to Tor

Continue Reading

Akira Ransomware Group Targets Critical Infrastructure, Extracts $42 Million EU Sanctions Russia Over Ongoing Cyber Espionage Campaign EU Sanctions Vitaly Kovalev, Ransomware Leader of Trickbot Group $15M Grinex Cyberattack Halts Operations Amid Allegations of Foreign Intelligence Involvement Conti Ransomware Group's Internal Messages Leaked Amid Ukraine Conflict Critical RCE Vulnerability in Veeam Backup Exposes Organizations to Attacks

Emergence of Vect RaaS Operation Targeting Organizations in Brazil and South Africa

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading