Broken VECT 2.0 ransomware acts as a data wiper for large files

Summary

Researchers discovered that VECT 2.0 ransomware has a critical flaw in its encryption nonce handling that causes files larger than 128 KB to be permanently destroyed rather than encrypted, rendering them unrecoverable even by the attackers. The flaw affects all variants (Windows, Linux, ESXi) and makes most enterprise files like databases, VM disks, and backups unrecoverable. VECT operators have partnered with TeamPCP to exploit victims of supply-chain attacks on Trivy, LiteLLM, and Telnyx.

Full text

Broken VECT 2.0 ransomware acts as a data wiper for large files By Bill Toulas April 28, 2026 05:25 PM 0 Researchers are warning that the VECT 2.0 ransomware has a problem in the way it handles encryption nonces that leads to permanently destroying larger files rather than encrypt them. VECT has been advertised on one of the latest BreachForums iterations, inviting registered users to become affiliates, and distributing access keys via private messages to those who showed interest. At some point, VECT operators announced a partnership with TeamPCP, the threat group responsible for the recent supply-chain attacks impacting Trivy, LiteLLM, and Telnyx, as well as an attack against the European Commission. In the announcement, VECT operators stated that their goal was to exploit victims of those supply-chain compromises, deploying ransomware payloads in their environments, as well as to conduct larger supply-chain attacks against other organizations. VECT operators' post on BreachForumsSource: Check Point Faulty ransomware While this is meant to increase encryption speed for larger files, because all chunk encryptions use the same memory buffer for the nonce output, each new nonce overwrites the previous one. Once all chunks are processed, only the last nonce generated remains in memory, and only that one is written to disk. As a result, the only portion of the file that is recoverable is the last 25%, with the previous three parts being impossible to decrypt, as the nonces have been lost. Those lost nonces aren’t transmitted to the attacker either, so even if VECT operators wanted to decrypt the files for victims paying the ransom, they wouldn’t be able to. Flawed nonce handling logicSource: Check Point While this is meant to increase encryption speed for larger files, because all chunk encryptions use the same memory buffer for the nonce output, each new nonce overwrites the previous one. Once all chunks are processed, only the last nonce generated remains in memory, and only that one is written to disk. As a result, the only portion of the file that is recoverable is the last 25%, with the previous three parts being impossible to decrypt, as the nonces have been lost. Those lost nonces aren’t transmitted to the attacker either, so even if VECT operators wanted to decrypt the files for victims paying the ransom, they wouldn’t be able to. The VECT 2.0 ransom noteSource: Check Point Check Point notes that, since most valuable enterprise files, including VM disks, database files, and backups, are above 128kb, VECT’s impact as a data wiper can be catastrophic in most environments. “At a threshold of only 128 KB, smaller than a typical email attachment or office document, what the code classifies as a large file encompasses not just VM disks, databases, and backups, but routine documents, spreadsheets, and mailboxes. In practice, almost nothing a victim would care to recover falls below this boundary,” Check Point says. The researchers found that the same nonce-handling flaw is present across all variants of the VECT 2.0 ransomware, including Windows, Linux, and ESXi, so the same data-wiping behavior applies across all cases. 99% of What Mythos Found Is Still Unpatched. AI chained four zero-days into one exploit that bypassed both renderer and OS sandboxes. A wave of new exploits is coming.At the Autonomous Validation Summit (May 12 & 14), see how autonomous, context-rich validation finds what's exploitable, proves controls hold, and closes the remediation loop. Claim Your Spot Related Articles: New Lotus data wiper used against Venezuelan energy, utility firmsMedtech giant Stryker fully operational after data-wiping attackTeamPCP deploys Iran-targeted wiper in Kubernetes attacksMedtech giant Stryker offline after Iran-linked wiper malware attackTrigona ransomware attacks use custom exfiltration tool to steal data

Indicators of Compromise

• malware — VECT 2.0

Entities