Broken VECT 2.0 ransomware acts as a data wiper for large files

Researchers are warning that the VECT 2.0 ransomware has a problem in the way it handles encryption nonces that leads to permanently destroying larger files rather than encrypt them.

VECT has been advertised on one of the latest BreachForums iterations, inviting registered users to become affiliates, and distributing access keys via private messages  to those who showed interest.

At some point, VECT operators announced a partnership with TeamPCP, the threat group responsible for the recent supply-chain attacks impacting Trivy, LiteLLM, and Telnyx, as well as an attack against the European Commission.

In the announcement, VECT operators stated that their goal was to exploit victims of those supply-chain compromises, deploying ransomware payloads in their environments, as well as to conduct larger supply-chain attacks against other organizations.

Faulty ransomware

While this is meant to increase encryption speed for larger files, because all chunk encryptions use the same memory buffer for the nonce output, each new nonce overwrites the previous one.

Once all chunks are processed, only the last nonce generated remains in memory, and only that one is written to disk.

As a result, the only portion of the file that is recoverable is the last 25%, with the previous three parts being impossible to decrypt, as the nonces have been lost.

Those lost nonces aren’t transmitted to the attacker either, so even if VECT operators wanted to decrypt the files for victims paying the ransom, they wouldn’t be able to.

While this is meant to increase encryption speed for larger files, because all chunk encryptions use the same memory buffer for the nonce output, each new nonce overwrites the previous one.

Once all chunks are processed, only the last nonce generated remains in memory, and only that one is written to disk.

As a result, the only portion of the file that is recoverable is the last 25%, with the previous three parts being impossible to decrypt, as the nonces have been lost.

Those lost nonces aren’t transmitted to the attacker either, so even if VECT operators wanted to decrypt the files for victims paying the ransom, they wouldn’t be able to.

Check Point notes that, since most valuable enterprise files, including VM disks, database files, and backups, are above 128kb, VECT’s impact as a data wiper can be catastrophic in most environments.

“At a threshold of only 128 KB, smaller than a typical email attachment or office document, what the code classifies as a large file encompasses not just VM disks, databases, and backups, but routine documents, spreadsheets, and mailboxes. In practice, almost nothing a victim would care to recover falls below this boundary,” Check Point says.

The researchers found that the same nonce-handling flaw is present across all variants of the VECT 2.0 ransomware, including Windows, Linux, and ESXi, so the same data-wiping behavior applies across all cases.

99% of What Mythos Found Is Still Unpatched.

AI chained four zero-days into one exploit that bypassed both renderer and OS sandboxes. A wave of new exploits is coming.

At the Autonomous Validation Summit (May 12 & 14), see how autonomous, context-rich validation finds what's exploitable, proves controls hold, and closes the remediation loop.

Claim Your Spot