SUBJECT PROFILE
Vect is a newly emerged RaaS operation identified by Halcyon and analyzed by Red Piranha, notable for building its encryptor in C++ from scratch (not repurposing LockBit 3.0 or Conti leaked code) and using ChaCha20-Poly1305 AEAD encryption — 2.5x faster than AES-256-GCM on non-accelerated hardware. The group demonstrates unusual operational maturity for its age: cross-platform targeting of Windows, Linux, and VMware ESXi; Safe Mode execution to suppress security tools; Monero-only payments; TOX protocol for affiliate communications; and exclusively TOR hidden services with no clearnet presence. Analysts from Red Piranha assess Vect is likely a rebrand or new venture by experienced RaaS operators, given the sophistication of its initial launch.
Financial — ransomware extortion with cross-platform custom malware and high-OPSEC affiliate program
OPERATIONAL HISTORY
T1486 (Data Encrypted for Impact — ChaCha20-Poly1305 with intermittent encryption), T1562 (Impair Defenses — Safe Mode execution to suppress EDR), T1071 (C2 over TOX protocol for encrypted P2P affiliate comms), T1041 (Exfiltration over C2 — double extortion), T1059 (Command and Scripting Interpreter), T1078 (Valid Accounts for initial access)
KNOWN INFRASTRUCTURE
Tor-only hidden services (no clearnet presence); Monero cryptocurrency for all payments; TOX protocol for encrypted affiliate-to-operator communications; custom C++ encryptor (ChaCha20-Poly1305 AEAD); web-based affiliate panel; dedicated leak site (TOR); affiliate program with $250 entry fee (waived for CIS applicants)