VECT ransomware, in addition to locking files, also erases files.

VECT ransomware, in addition to locking files, also erases files larger than 128KB.

Ransomware can be called a catastrophe of the age, especially for businesses that, if hit by this type of malware, can lead to the closure of their business. This malware, in addition to its malignancy, is constantly evolving to intensify their horrors every day.

According to a report by the Computer Weekly website, the detection of a new ransomware, Vect, by a research team from Check Point Research (CPR), a subsidiary of the company that develops solutions for enterprise cybersecurity, Check Point has been detecting such ransomware since the end of 2025. (2025). In reviewing the encryption section to lock the file hostage, the research team found that the encryption system had a serious vulnerability that caused the encryption system to instead encrypt the normal hostage-taking file lock and clear all the data in the file (Wipe). As a result, even if the victim sends money to the hackers, the file cannot be unlocked.

The vulnerability detected, the research team found that when the ransomware detected files larger than 128 KB (which at the enterprise level refers to almost all the files that the organization has, from Virtual Machine Image, Database, and Backup), the encryption tool encrypted and destroyed the Recovery file. This vulnerability led the research team to change the definition of this malware from the ransomware to the Wiper or data erasure tool instead, because the active and unsalvaged data was used. The technique is considered to have been permanently deleted. This vulnerability has been found by the research team since before the public 2.0 version of Vect ransomware was released to hackers in the industry. This vulnerability affected the Windows, Linux, and EXXi versions of ransomware.

The research team has speculated that the vulnerability may have come from an erroneous coding that made the ransomware technically different to what the ransomware should be. In addition, the Vect ransomware, despite heavy advertising, has a partnership with the TeamPCP Group and the BreachForums underground web board to launch this ransomware, along with a promotion to give registered members of the web board free access to the ransomware, but the Vect ransomware is not advertised. Many features are not available, such as speed adjustment features. The encryption of the file was not practical, the Anti-Sandbox Anti-Sandbox feature was not available. The research team was able to conveniently test malware on the Sandbox. In addition, the ransomware itself has not been completely rewritten as it was boasted. It has been detected that many of the code is similar to the ransomware code that came out during 2022 (2022) or older, because the code included Ukraine as one of the countries where the ransomware was excluded (Exclusion), which is strange from Russian malware in the post-Ukrainian-Russian war. Ukraine is usually excluded from the account.

As a result, in addition to being vigilant against ransomware, the research team has also suggested that if there is an explosion, pay the hackers, because they will not get the data back.

# Trending # Lemon 8 Howtoo # lemon 8 diary # vect # freedomhack