VECT is an affiliate-run locker with builds for Windows, Linux and VMware ESXi. It appends .vect to affected files, writes a text note headed README, and on Windows replaces the wallpaper with a VECT 2.0 banner. The note opens by addressing company management, names ChaCha20 as the cipher and lists a qTox identifier as a fallback to its Tor chat portal. The programme surfaced on a Russian-language forum in late 2025 and later opened affiliate access to members of a large cybercrime forum. Its note claims that databases and backups were taken. A defect in the 2.0 builds mishandles keys so that files above roughly 128 KB are irreversibly damaged, meaning neither the operators nor anyone else can fully restore them.
File extensions: .vect
Ransom note filenames: !!!READ_ME!!!.txt
Decryptor: No public decryptor was found. Checked 2026-10-14.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161