Executive Summary
Check Point Research has identified a catastrophic implementation flaw in VECT 2.0 ransomware that effectively renders it a data wiper. The malware uses the ChaCha20-IETF stream cipher but incorrectly generates four unique nonces for files larger than 128 KB while only saving the final one to disk. This flaw makes the first 75% of any large file — including databases, virtual machine disks, and backups — irrecoverable by anyone, including the threat actors themselves.
VECT has established a significant operational presence through partnerships with TeamPCP and BreachForums, leveraging supply-chain compromises of tools like Trivy, LiteLLM, and KICS to target downstream victims. Despite its professional facade and multi-platform support for Windows, Linux, and ESXi, the technical execution is marked by amateur errors, such as non-functional encryption speed flags and self-canceling obfuscation routines.