Researchers Warn of New “Vect” RaaS Variant

A new RaaS operation named Vect has been identified, claiming two victims in Brazil and South Africa and recruiting affiliates; it uses custom C++ ransomware employing ChaCha20-Poly1305 and intermittent block encryption, targets Windows/Linux/VMware ESXi, leverages Safe Mode evasion and strong OPSEC (Monero payments, TOX, TOR), and follows a double-extortion model. Analysts recommend hardening remote access (RDP/VPN/Fortinet), segmenting management networks, monitoring for Safe Mode and rapid selective encryption patterns, and deploying preventative anti-ransomware controls.