Ransomvibe Malware — Analysis, Campaigns & Threat Activity

Threat entity extracted from intelligence sources

Frequency
2
occurrences
First Seen
November 7, 2025
Last Seen
November 10, 2025

Ransomvibe, also referred to as Vibe, is a newly identified ransomware family.

Overview

Ransomvibe, also referred to as Vibe, is a newly identified ransomware family. It gained attention after a Vibe-coded proof-of-concept surfaced publicly and was reported as an emerging threat, with its presence on Microsoft’s marketplace highlighting the growing accessibility of ransomware tooling and the potential for rapid deployment against Windows environments. This makes Ransomvibe a notable development in the evolving ransomware landscape and a priority for monitoring and defense.

Related Threat Clusters

  • Malicious Ransomware Extensions Found on Microsoft VS Code Marketplace

    A ransomware-style extension named susvsex, created with basic capabilities and labeled as 'vibe-coded,' was discovered on Microsoft's official VS Code marketplace. The extension, published by 'suspublisher18,' openly…

    2 articles · Updated November 7, 2025
  • Ransomvibe Ransomware Discovered in VS Code Extensions

    A strain of ransomware behavior, referred to as Ransomvibe, has been embedded in Visual Studio Code extensions. The malicious extension, named susvsex, was published by an actor identified as 'suspublisher18' and openly…

    3 articles · Updated November 7, 2025

Recent Intelligence Reports

  • Vibe — Csoonline · November 10, 2025
  • Vibe-coded ransomware proof-of-concept ended up on Microsoft’s marketplace — Csoonline · November 7, 2025

CVSS v3.1 Breakdown