vect
First seen January 6, 2026Active25 claimed victims
The claims below are reproduced as posted by vect on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
VECT is a RaaS group that launched its affiliate program in December 2025 with a five-tier revenue-sharing model and a formal partnership with BreachForums; its VECT 2.0 payload contains a critical encryption flaw that irreversibly destroys files larger than 128 KB rather than encrypting them.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| guesty, LITELLM/TRIVY CAMPAIGN (TEAMPCP) | April 15, 2026 | ransomware_live | — |
| Verlat Energy | March 2, 2026 | ransomware_live | — |
| keliweb | February 28, 2026 | ransomware_live | — |
| Casas del Mediterraneo | February 28, 2026 | ransomware_live | — |
| jdaas | February 28, 2026 | ransomware_live | — |
| USHA International Limited | February 28, 2026 | ransomware_live | — |
| Del Rey | February 25, 2026 | ransomware_live | — |
| Sus Insumos S.A.S | February 25, 2026 | ransomware_live | — |
| Pappytech | February 24, 2026 | ransomware_live | — |
| pay*** | February 24, 2026 | ransomware_live | — |
| for******a****ng | February 24, 2026 | ransomware_live | — |
| ***wire | February 24, 2026 | ransomware_live | — |
| ****360.com | February 24, 2026 | ransomware_live | — |
| a*f***a | February 24, 2026 | ransomware_live | — |
| s***om****x | February 24, 2026 | ransomware_live | — |
| MB Contabilidade | February 24, 2026 | ransomware_live | — |
| ApexHospitals | February 19, 2026 | ransomware_live | — |
| EnerTec | February 13, 2026 | ransomware_live | — |
| Mutualista Imbabura | February 13, 2026 | ransomware_live | — |
| Was Madeiras | February 13, 2026 | ransomware_live | — |
| Grupo VerdeAzul | February 13, 2026 | ransomware_live | — |
| Auvo | February 13, 2026 | ransomware_live | — |
| Hytec South Africa | January 5, 2026 | ransomware_live | — |
| Federal University of Sergipe | January 5, 2026 | ransomware_live | — |
| S&PGLOBAL, LiteLLM/Trivy campaign (TeamPCP) | October 5, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).