New Ransomware Threat "Vect", Permanently Damages Files, Making Ransoms Useless

The ransomware threat is typically known for “kidnapping” victims’ data and demanding a ransom to recover the seized files. However, the latest findings reveal a type of ransomware that is even more dangerous. Ransomware named Vect 2.0 is reported to have a design flaw that makes it function unusually. Instead of encrypting data to hold it hostage, this malware permanently destroys victims’ files. This discovery was revealed by security researchers from Check Point. They describe Vect 2.0 as more akin to a “data wiper” or data eraser than ransomware. Technically, Vect 2.0 attempts to encrypt files by dividing them into several parts. However, there is a fatal error in that process. Of the four encryption codes (nonces) generated, only one is saved, while the other three are lost. As a result, files larger than 128 KB are not encrypted properly. Instead, those files are overwritten with random data that cannot be recovered. The impact is that victims not only lose access but also lose the data completely. Even if the ransom is paid, the files cannot be restored because they have been completely deleted. The types of data affected are varied, from documents and spreadsheets to databases. This could cripple a company’s operations in a short time. Vect 2.0 is known to support various platforms, including Windows, Linux, and the ESXi virtualisation system. The same design flaw is found across all those versions, indicating the use of a uniform code base. Additionally, this ransomware has several other bugs, including performance degradation during the encryption process. Researchers assess that Vect 2.0 is likely still an early, immature version of a more complex Ransomware-as-a-Service framework. Although it is currently “flawed”, its threat potential remains significant if those bugs are fixed in future versions.