{"id":236664,"date":"2026-04-28T10:01:00","date_gmt":"2026-04-28T14:01:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/04\/28\/vect-2-0-ransomware-irreversibly-destroys-files-over-131kb-on-windows-linux-esxi\/"},"modified":"2026-04-28T12:05:08","modified_gmt":"2026-04-28T16:05:08","slug":"vect-2-0-ransomware-irreversibly-destroys-files-over-131kb-on-windows-linux-esxi","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/04\/28\/vect-2-0-ransomware-irreversibly-destroys-files-over-131kb-on-windows-linux-esxi\/","title":{"rendered":"VECT 2.0 Ransomware Irreversibly Destroys Files Over 131KB on Windows, Linux, ESXi"},"content":{"rendered":"

VECT 2.0 Ransomware Irreversibly Destroys Files Over 131KB on Windows, Linux, ESXi<\/a><\/p>\n

https:\/\/thehackernews.com\/2026\/04\/vect-20-ransomware-irreversibly.html<\/a><\/p>\n

Publish Date: 2026-04-28 10:01:00<\/a><\/p>\n

Source Domain: thehackernews.com<\/a><\/p>\n

Threat hunters are warning that the cybercriminal operation known as VECT 2.0<\/strong> acts more like a wiper than a ransomware due to a critical flaw in its encryption implementation across Windows, Linux, and ESXi variants that renders recovery impossible even for the threat actors.<\/p>\n

The fact that VECT’s locker permanently destroys large files rather than encrypting them means even victims who opt to pay the ransom cannot get their data back, as the decryption keys are discarded by the malware during the time encryption occurs.<\/p>\n

“VECT is being marketed as ransomware, but for any file over 131KB \u2013 which is most of what enterprises actually care about \u2013 it functions as a data destruction tool,” Eli Smadja, group manager at Check Point Research, said in a statement shared with The Hacker News.<\/p>\n

“CISOs need to understand that in a VECT incident, paying is not a recovery strategy. There is no decrypter that can be handed over, not because the attackers are unwilling, but because the information required to build one was destroyed the moment their software ran. The focus has to be on resilience: offline backups, tested recovery procedures, and rapid containment \u2013 not negotiation.”<\/p>\n

VECT (now rebranded as VECT 2.0) is a ransomware-as-a-service (RaaS) scheme that first launched its affiliate program in December 2025. On its dark website, the group displays the message “Exfiltration \/ Encryption \/ Extortion,” highlighting its triple-threat business model.<\/p>\n

According to an analysis published by the Data Security Council of India (DSCI) last month, a $250 entry fee, payable in Monero (XMR), is required for new affiliates. The fee is waived for applicants from the Commonwealth of Independent States (CIS) countries, indicating an attempt to recruit individuals from the region.<\/p>\n

In recent weeks, the group has established a formal partnership with the BreachForums cybercrime marketplace and the TeamPCP hacking group, in a move aimed at further lowering the barrier to entry for…<\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

VECT 2.0 Ransomware Irreversibly Destroys Files Over 131KB on Windows, Linux, ESXi https:\/\/thehackernews.com\/2026\/04\/vect-20-ransomware-irreversibly.html Publish Date:…<\/p>\n","protected":false},"author":1,"featured_media":236665,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEji1Auw0eR5oiVkEiB8JPzjSCaFsUUiAOfNHrcsOzO4DElBB4gbQ20uu3p69nojIkLsgxZOj81fa7fK_dchUAx0WINAGMq3X0VSA7LH_Isc1hPAvls76rdLeSYCn40zw8P2xAikVwxb_pclaNQXER8G7nzPO41LAl0-ELu-i60_RLl7CLCWcC9gGrEC8oXw\/s1600\/vect.gif","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[28,35,32],"class_list":["post-236664","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-data-security","tag-hacker","tag-malware"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/236664"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=236664"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/236664\/revisions"}],"predecessor-version":[{"id":236666,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/236664\/revisions\/236666"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/236665"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=236664"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=236664"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=236664"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}