EXECUTIVE SUMMARY
Vect 2.0 ransomware contains a critical implementation flaw that results in permanent destruction of large files instead of encryption, making recovery impossible even if the ransom is paid. The issue stems from improper nonce handling in its ChaCha20-based encryption across Windows, Linux, and ESXi variants. As a result, the malware effectively behaves as a data wiper, posing a severe risk to enterprise environments.
- Active Region: Global
- Affected Sector: All sectors (particularly enterprise, cloud, and virtualization environments)
- Affected Malware: VECT 2.0 Ransomware (Windows, Linux, ESXi variants)
- Severity: Critical (destructive wiper behavior causing irreversible data loss)
- Published Date: April 28, 2026
TECHNICAL DETAILS
This is a cryptographic implementation flaw in the ransomware design, where improper nonce handling in ChaCha20-IETF encryption leads to irreversible data loss.
- Target: Enterprise systems including Windows, Linux servers, and VMware ESXi hypervisors, particularly large files (>128 KB) such as databases, VM disks, backups, and documents.
- Root Cause: Incorrect nonce management during multi-chunk encryption. Multiple unique nonces are generated for different data segments, but only the final nonce is retained while the others are discarded. Since each encrypted segment requires its corresponding nonce for decryption, this results in irreversible data loss, making recovery mathematically impossible.
- Prerequisite For Exploitation: Successful exploitation requires only the delivery and execution of VECT 2.0 ransomware on the target system, which may occur through……
